Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 61:

  Can you stop or pause the searching?

  A. No

  B. Yes

  Correct Answer: B

• Question 62:

  When is the pipe character, I, used in search strings?

  A. Before clauses. For example: stats sum(bytes) | by host

  B. Before commands. For example: | stats sum(bytes) by host

  C. Before arguments. For example: stats sum| (bytes) by host

  D. Before functions. For example: stats |sum(bytes) by host

  Correct Answer: B

• Question 63:

  Forward Option gather and forward data to indexers over a receiving port from remote machines.

  A. False

  B. True

  Correct Answer: B

• Question 64:

  Assuming a user has the capability to edit reports, which of the following are editable?

  A. Acceleration, schedule, permissions

  B. The report's name, schedule, permissions

  C. The report's name, acceleration, schedule

  D. The report's name, acceleration, permissions

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Report/Createandeditreports

• Question 65:

  Which Field/Value pair will return only events found in the index named security?

  A. Index=Security

  B. index=Security

  C. Index=security

  D. index!=Security

  Correct Answer: B

  Reference: https://answers.splunk.com/answers/712164/why-are-the-wineventlogssecurity- indexing-indiffe.html

• Question 66:

  Splunk Components:

  Which of the following are responsible for reducing search results?

  A. search heads

  B. indexers

  C. forwarders

  Correct Answer: B

• Question 67:

  How many main user roles do you have in Splunk?

  A. 2

  B. 4

  C. 1

  D. 3

  Correct Answer: D

• Question 68:

  Which of the following fields is stored with the events in the index?

  A. user

  B. source

  C. location

  D. sourcelp

  Correct Answer: B

• Question 69:

  What is the default lifetime of every Splunk search job?

  A. All search jobs are saved for 10 days

  B. All search jobs are saved for 10 hours

  C. All search jobs are saved for 10 weeks

  D. All search jobs are saved for 10 minutes

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Extendjoblifetimes

• Question 70:

  Every Search in Splunk is also called _____________.

  A. None of the above

  B. Job

  C. Search Only

  Correct Answer: B