Splunk Splunk Certifications SPLK-1001 Questions & Answers

• Question 71:

  When editing a dashboard, which of the following are possible options? (select all that apply)

  A. Add an output.

  B. Export a dashboard panel.

  C. Modify the chart type displayed in a dashboard panel.

  D. Drag a dashboard panel to a different location on the dashboard.

  Correct Answer: D

• Question 72:

  Portal for Splunk apps can be accessed through www.splunkbase.com

  A. False

  B. True

  Correct Answer: B

• Question 73:

  Splunk users are assigned roles. Which of the following do roles determine?

  A. Password

  B. Port number

  C. Username

  D. Data access

  Correct Answer: D

  This is the correct answer because roles determine the level of access that users have to the Splunk platform and the tasks that they can perform on the platform. Roles can contain one or more capabilities that provide access to specific parts of the Splunk platform, such as searching, indexing, alerting, and so on2. Roles can also specify which indexes that a user can search and which indexes are searched by default.

• Question 74:

  What is one benefit of creating dashboard panels from reports?

  A. Any newly created dashboard will include that report.

  B. There are no benefits to creating dashboard panels from reports.

  C. It makes the dashboard more efficient because it only has to run one search string.

  D. Any change to the underlying report will affect every dashboard that utilizes that report.

  Correct Answer: C

• Question 75:

  A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?

  A. Click All Fields and select the field to add it to Selected Fields.

  B. Click Interesting Fields and select the field to add it to Selected Fields.

  C. Click Selected Fields and select the field to add it to Interesting Fields.

  D. This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.

  Correct Answer: A

• Question 76:

  Which of the following is true about user account settings and preferences?

  A. Search and Reporting is the only app that can be set as the default application.

  B. Full names can only be changed by accounts with a Power User or Admin role.

  C. Time zones are automatically updated based on the setting of the computer accessing Splunk.

  D. Full name, time zone, and default app can be defined by clicking the login name in the Splunk bar.

  Correct Answer: D

• Question 77:

  In automatic lookup definitions, the _____ fields are those that are not in the event data.

  A. input

  B. output

  Correct Answer: B

• Question 78:

  Which of the following is a false statement about Splunk dashboards?

  A. Dashboards must have a unique dashboard ID within a permission's context.

  B. Splunk dashboards consist of one or more panels displaying data visually in a useful way.

  C. Splunk dashboards may not be directly created from search results without first creating a report.

  D. Splunk dashboard panels can be populated by reports.

  Correct Answer: C

  According to the Splunk documentation, dashboards are collections of views that you can use to visually analyze your data. You can create dashboards using simple XML, or use the Splunk Web framework to build custom dashboards using HTML, CSS, and JavaScript. Dashboards consist of one or more panels that display data in a variety of ways. You can use charts, tables, maps, single value indicators, and other visualizations to display your data. You can also add interactive elements to your dashboards, such as filters, drilldowns, and time range pickers, to make them more dynamic and user-friendly. To create a dashboard panel from a search result, you can use the Save As button in the Search app and select Dashboard Panel. This will open a dialog box where you can choose an existing dashboard or create a new one, and specify the panel title and visualization type. You can also edit the panel properties and permissions before saving it to the dashboard. Alternatively, you can create a report from a search result and then add it to a dashboard as a panel. Reports are saved searches that include additional attributes such as a visualization type, permissions, and an optional description. You can create reports using the Save As button in the Search app and select Report. To add a report to a dashboard, you can use the Add to Dashboard button in the Reports listing page or in the report itself. Dashboards must have a unique dashboard ID within a permission's context. This means that you cannot have two dashboards with the same ID in the same app or user space. The dashboard ID is used to reference the dashboard in URLs and XML files. You can specify the dashboard ID when you create a new dashboard using simple XML or the Splunk Web framework. If you do not specify an ID, Splunk software will generate one based on the dashboard title.

• Question 79:

  @ Symbol can be used in advanced time unit option.

  A. No

  B. Yes

  Correct Answer: B

• Question 80:

  Splunk apps are used for following (Choose three.):

  A. Designed to cater numerous use cases and empower Splunk.

  B. We can not install Splunk App.

  C. Allows multiple workspaces for different use cases/user roles.

  D. It is collection of different Splunk config files like data inputs, UI and Knowledge Object.

  Correct Answer: ACD