Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 21:

  By default search results are not returned in ________ order.

  A. Chronological

  B. Reverser chronological

  C. ASCIE

  D. Alphabetical

  Correct Answer: AD

• Question 22:

  Which of the following is a Splunk internal field?

  A. _raw

  B. host

  C. _host

  D. index

  Correct Answer: A

• Question 23:

  Fields are searchable name and value pairings that differentiates one event from another.

  A. False

  B. True

  Correct Answer: B

• Question 24:

  Which command will rename action to Customer Action?

  A. | rename action = CustomerAction

  B. | rename Action as "Customer Action"

  C. | rename Action to "Customer Action"

  D. | rename action as "Customer Action"

  Correct Answer: D

  Reference: https://answers.splunk.com/answers/610038/understanding-command-in-search.html

• Question 25:

  What are the two most efficient search filters?

  A. _time and host

  B. _time and index

  C. host and sourcetype

  D. index and sourcetype

  Correct Answer: B

  This is the correct answer because these two filters can help you limit the amount of data that Splunk retrieves from disk, which is the key to fast searching1. The _time filter allows you to specify a narrow time window for your search, which reduces the number of buckets that Splunk scans2. The index filter allows you to specify which index or indexes contain the data that you want to search, which reduces the number of files that Splunk reads3.

• Question 26:

  Which of the statements are correct? (Choose three.)

  A. Zoom to selection: Narrows the time range and re-executes the search.

  B. Zoom to selection: Narrows the time range and doesn't re-executes the search.

  C. Format Timeline: Hides or shows the timeline in different views.

  D. Zoom-Out: Expands the time focus and doesn't re-executes the search.

  E. Zoom-out: Expands the time focus and re-executes the search.

  Correct Answer: ACE

• Question 27:

  How can results from a specified static lookup file be displayed?

  A. lookup command

  B. inputlookup command

  C. Settings > Lookups > Input

  D. Settings > Lookups > Upload

  Correct Answer: B

• Question 28:

  Which statement is true about Splunk alerts?

  A. Alerts are based on searches that are either run on a scheduled interval or in real-time.

  B. Alerts are based on searches and when triggered will only send an email notification.

  C. Alerts are based on searches and require cron to run on scheduled interval.

  D. Alerts are based on searches that are run exclusively as real-time.

  Correct Answer: A

• Question 29:

  Which events will be returned by the following search string?

  host=www3 status=503

  A. All events that either have a host of www3 or a status of 503.

  B. All events with a host of www3 that also have a status of 503

  C. We need more information: we cannot tell without knowing the time range

  D. We need more information a search cannot be run without specifying an index

  Correct Answer: B

• Question 30:

  != and NOT are same arguments.

  A. True

  B. False

  Correct Answer: B