Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 41:

  What does the rare command do?

  A. Returns the least common field values of a given field in the results.

  B. Returns the most common field values of a given field in the results.

  C. Returns the top 10 field values of a given field in the results.

  D. Returns the lowest 10 field values of a given field in the results.

  Correct Answer: A

• Question 42:

  After running a search, what effect does clicking and dragging across the timeline have?

  A. Executes a new search.

  B. Filters current search results.

  C. Moves to past or future events.

  D. Expands the time range of the search.

  Correct Answer: B

• Question 43:

  Which of the following index searches would provide the most efficient search performance?

  A. index=*

  B. index=web OR index=s*

  C. (index=web OR index=sales)

  D. *index=sales AND index=web*

  Correct Answer: C

• Question 44:

  Which of the following is the best description of Splunk Apps?

  A. Built only by Splunk employees.

  B. A collection of files.

  C. Only available for download on Splunkbase.

  D. Available on iOS and Android.

  Correct Answer: B

  The best description of Splunk Apps is a collection of files that provide specific functionality or views of your data. Splunk Apps can be built by anyone, not only by Splunk employees. Splunk Apps are not only available for download on Splunkbase, but also can be created or customized by users. Splunk Apps are not available on iOS and Android, but rather on Splunk Enterprise or Splunk Cloud platforms.

• Question 45:

  How are the results of the following search sorted? ... | sort action, --file, +bytes

  A. In descending order by action, then descending order by file, and lastly by ascending order of bytes.

  B. In ascending order by action, then descending order by file, and lastly by ascending order of bytes.

  C. In descending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

  D. In ascending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

  Correct Answer: B

  Using a minus sign (-) for descending order and a plus sign (+) for ascending order. If no sign is specified, the default order is ascending. Sorting by multiple fields in the order they are specified. If there are duplicate values in one field, the next field is used to break the tie. Sorting by field values according to their types. If the field type is not specified, the sort command tries to automatically determine it.

• Question 46:

  Which statement is true about the top command?

  A. It returns the top 10 results

  B. It displays the output in table format

  C. It returns the count and percent columns per row

  D. All of the above

  Correct Answer: D

• Question 47:

  Will the queries following below get the same result?

  1.

  index=log sourcetype=error_log status !=100

  2.

  index=log sourcetype=error_log NOT status =100

  A. Yes

  B. No

  Correct Answer: B

• Question 48:

  Splunk extracts fields from event data at index time and at search time.

  A. True

  B. False

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchTutorial/Usefieldstosearch

• Question 49:

  When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

  A. |

  B. $

  C. !

  D. ,

  Correct Answer: D

• Question 50:

  In the Fields sidebar, what does the number directly to the right of the field name indicate?

  A. The value of the field

  B. The number of values for the field

  C. The number of unique values for the field

  D. The numeric non-unique values of the field

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchTutorial/Usefieldstosearch