Splunk Splunk Enterprise Certified Architect SPLK-2001 Questions & Answers

• Question 1:

  For a KV store, a lookup stanza in the transforms.conf file must contain which of the following? (Select all that apply.)

  A. collection

  B. fields_list

  C. external_type

  D. internal_type

  Correct Answer: AB

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/ConfigureKVstorelookups

• Question 2:

  Which of the following will unset a token named my_token?

  A. $my_token$

  B.

  C. false

  D. disabled

  Correct Answer: B

  Reference: https://community.splunk.com/t5/Dashboards-Visualizations/Unset-a-token-if-it-is-equal-to-avalue/m-p/353512

• Question 3:

  Data can be added to a KV store collection in which of the following format(s)?

  A. JSON

  B. JSON, XML

  C. JSON, XML, CSV

  D. JSON, XML, CSV, TXT

  Correct Answer: A

  Reference: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/ usingconfigurationfiles/

• Question 4:

  A dashboard is taking too long to load. Several searches start with the same SPL. How can the searches be optimized in this dashboard? (Select all that apply.)

  A. Convert searches to include NOT expressions.

  B. Restrict the time range of the search as much as possible.

  C. Replace | stats command with | transaction command wherever possible.

  D. Convert the common SPL into a Global Search and convert the other searches to post-processing searches.

  Correct Answer: CD

• Question 5:

  Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

  A. stats

  B. tstats

  C. tscollect

  D. transaction

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Tstats

• Question 6:

  When using the Splunk Web Framework to create a global search, which is the correct post-process

  syntax for the base search shown below?

  var searchmain = new SearchManager{{

  id: "base-search",

  search: "index= internal | head 10 | fields "*",

  preview: true,

  cache: true

  }};

  A. var mypostproc1 = new PostProcessManager {{ id: "post1", managerid: "base-search", search: "| stats count by sourcetype" }};

  B. var mypostproc1 = new PostProcessManager{{ id: "post1", managerid: "base", search: "| stats count by sourcetype" }};

  C. var mypostproc1 = new PostProcess{{ id: "post1", managerid: "base-search", search: "| search stats count by sourcetype" }};

  D. You cannot create global searches in the Splunk Web Framework.

  Correct Answer: A

• Question 7:

  Which of the following are valid parent elements for the event action shown below? (Select all that apply.)

  sourcetype=$click.value|s$

  A.

  B.

  C.

  D.

  Correct Answer: AC

• Question 8:

  In a DELETE request, what would omitting the value of _key from the REST endpoint do?

  A. Clean the KV store, deleting all content.

  B. Produce the syntax error "Key value missing".

  C. Cause all records in a collection to be deleted.

  D. Mean that the _key value must be passed as an argument.

  Correct Answer: C

• Question 9:

  Which of the following is a way to monitor app performance? (Select all that apply.)

  A. Using Splunk logs.

  B. Using the search job inspector.

  C. Using the Monitoring Console.

  D. Using the storage/collections/config REST endpoint.

  Correct Answer: AC

• Question 10:

  Which files within an app contain permissions information? (Select all that apply.)

  A. local/metadata.conf

  B. metadata/local.meta

  C. default/metadata.conf

  D. metadata/default.meta

  Correct Answer: CD

  Reference: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/ manageaccesstocustom/