Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 51:

  It is mandatory for the lookup file to have this for an automatic lookup to work.

  A. Source type

  B. At least five columns

  C. Timestamp

  D. Input filed

  Correct Answer: D

• Question 52:

  What is Search Assistant in Splunk?

  A. It is only available to Admins.

  B. Such feature does not exist in Splunk.

  C. Shows options to complete the search string

  Correct Answer: C

• Question 53:

  A collection of items containing things such as data inputs, UI elements, and knowledge objects is known as what?

  A. An app

  B. JSON

  C. A role

  D. An enhanced solution

  Correct Answer: A

• Question 54:

  Data summary button just below the search bar gives you the following (Choose three.):

  A. Hosts

  B. Sourcetypes

  C. Sources

  D. Indexes

  Correct Answer: ABD

• Question 55:

  What happens when a field is added to the Selected Fields list in the fields sidebar'?

  A. Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field

  B. Splunk will highlight related fields as a suggestion to add them to the Selected Fields list.

  C. Custom selections will replace the Interesting Fields that Splunk populated into the list at search time

  D. The selected field and its corresponding values will appear underneath the events in the search results

  Correct Answer: D

• Question 56:

  Which of the following describes lookup files?

  A. Lookup fields cannot be used in searches

  B. Lookups contain static data available in the index

  C. Lookups add more fields to results returned by a search

  D. Lookups pull data at index time and add them to search results

  Correct Answer: B

• Question 57:

  There are three different search modes in Splunk (Choose three.):

  A. Automatic

  B. Smart

  C. Fast

  D. Verbose

  Correct Answer: BCD

• Question 58:

  Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

  A. (index=netfw failure) AND index=netops warn OR critical

  B. (index=netfw failure) OR (index=netops (warn OR critical))

  C. (index=netfw failure) AND (index=netops (warn OR critical))

  D. (index=netfw failure) OR index=netops OR (warn OR critical)

  Correct Answer: B

• Question 59:

  Parsing of data can happen both in HF and Indexer.

  A. Only HF

  B. No

  C. Yes

  Correct Answer: C

• Question 60:

  What type of search can be saved as a report?

  A. Any search can be saved as a report

  B. Only searches that generate visualizations

  C. Only searches containing a transforming command

  D. Only searches that generate statistics or visualizations

  Correct Answer: D

  Only searches that generate statistics or visualizations can be saved as a report. These are searches that contain a transforming command, such as stats, chart, timechart, top, rare, etc. Transforming commands create a data table from the events and enable various types of visualizations. Searches that do not contain a transforming command can only be saved as an alert or a dashboard panel. References: Splunk Core User Certification Exam Study Guide, page 35.