Splunk Splunk Certifications SPLK-2001 Questions & Answers

• Question 21:

  How can event logs be collected from a remote Windows machine using a standard Splunk installation and no customization? (Select all that apply.)

  A. By configuring a WMI input.

  B. By using HTTP event collector.

  C. By using a Windows heavy forwarder.

  D. By using a Windows universal forwarder.

  Correct Answer: AD

• Question 22:

  To delete the record with a _key value of smith from the sales collection, a DELETE request should be sent to which REST endpoint?

  A. /storage/collections/sales/smith

  B. /storage/kvstore/data/sales/smith

  C. /storage/collections/data/sales/smith

  D. /storage/kvstore/collections/sales/smith

  Correct Answer: C

• Question 23:

  What predefined drilldown tokens are available specifically for trellis layouts? (Select all that apply.)

  A. trellis.Xaxis

  B. trellis.Yaxis

  C. trellis.name

  D. trellis.value

  Correct Answer: CD

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/VisualizationTrellis

• Question 24:

  A user wants to add the token $token_name$ to a dashboard for use in a drilldown. Which token filter encodes URL values?

  A. $$token_name$$

  B. $token_name|h$

  C. $token_name|n$

  D. $token_name|u$

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/tokens

• Question 25:

  Which of the following is a security best practice?

  A. Enable XSS.

  B. Eliminate all escape characters.

  C. Ensure the app passes App Certification.

  D. Ensure components have no Common Vulnerabilities and Exposures (CVE) vulnerabilities.

  Correct Answer: D

• Question 26:

  Which event handler uses the element to support pan and zoom functionality?

  A. Visualization event handler

  B. Form input event handler

  C. Condition event handler

  D. Search event handler

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/EventHandlerReference

• Question 27:

  Which of the following formats are valid for a Splunk REST URI?

  A. host:port/endpoint

  B. scheme://host/servicesNS/*/

  C. $SPLUNK HOME/services/endpoint

  D. scheme://host:port/services/endpoint

  Correct Answer: D

• Question 28:

  Which HTTP Event Collector (HEC) endpoint should be used to collect data in the following format? {"message":"Hello World", "foo":"bar", "pony":"buttercup"}

  A. data/inputs/http/{name}

  B. services/collector/raw

  C. services/collector

  D. data/inputs/http

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/HECExamples

• Question 29:

  The response message from a successful Splunk REST call includes an element. What is contained in an element?

  A. A dictionary of elements.

  B. Metadata encapsulating the element.

  C. A response code indicating success or failure.

  D. An individual element in an collection.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing

• Question 30:

  Which of the following are valid request arguments for the REST search endpoints? (Select all that apply.)

  A. latest_time=rt

  B. latest_time=now

  C. earliest_time=-5h@h

  D. earliest_time=rt_10m@m

  Correct Answer: BC

  Reference: https://community.splunk.com/t5/Getting-Data-In/How-to-create-Search-via-REST-api-inverbose-mode/td-p/406400