Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 31:

  When is an alert triggered?

  A. When Splunk encounters a syntax error in a search

  B. When a trigger action meets the predefined conditions

  C. When an event in a search matches up with a data model

  D. When results of a search meet a specifically defined condition

  Correct Answer: D

• Question 32:

  Monitor option in Add Data provides _______________.

  A. Only continuous monitoring.

  B. Only One-time monitoring.

  C. None of the above.

  D. Both One-time and continuous monitoring

  Correct Answer: D

• Question 33:

  Which of the following is the most efficient search?

  A. index=* "failed password"

  B. "failed password" index=*

  C. (index=* OR index=security) "failed password"

  D. index=security "failed password"

  Correct Answer: A

• Question 34:

  When viewing results of a search job from the Activity menu, which of the following is displayed?

  A. New events based on the current time range picker

  B. The same events based on the current time range picker

  C. The same events from when the original search was executed

  D. New events in addition to the same events from the original search

  Correct Answer: C

• Question 35:

  Field names are case sensitive.

  A. True

  B. False

  Correct Answer: A

• Question 36:

  When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?

  A. CSV, JSON, PDF

  B. CSV, XML JSON

  C. Raw Events, XML, JSON

  D. Raw Events, CSV, XML, JSON

  Correct Answer: D

• Question 37:

  Which of the following is an accurate definition of fields within Splunk?

  A. Inherent entities that exist in event data.

  B. A searchable key/value pair in event data.

  C. Values pulled exclusively from lookup tables.

  D. A non-searchable name/value pair used while indexing data.

  Correct Answer: A

  Fields are searchable key/value pairs in event data. They allow you to specify criteria for your searches and filter out unwanted events. Fields can be extracted automatically by Splunk software during indexing or searching, or manually by users using various methods. Fields are not inherent entities that exist in event data, but rather interpretations of data by Splunk software or users. Fields are not values pulled exclusively from lookup tables, although lookup tables can be used to add fields to events based on existing fields. Fields are not non-searchable name/value pairs used while indexing data, but rather searchable attributes that can be used to refine searches5.

• Question 38:

  What result will you get with following search index=test sourcetype="The_Questionnaire_P*" ?

  A. the_questionnaire _pedia

  B. the_questionnaire pedia

  C. the_questionnaire_pedia

  D. the_questionnaire Pedia

  Correct Answer: C

• Question 39:

  Matching search terms are highlighted.

  A. Yes

  B. No

  Correct Answer: A

• Question 40:

  Which symbol is used to snap the time?

  A. @

  B. and

  C. *

  D. #

  Correct Answer: A