SPLK-1001 Practice Exam Questions with Answers Splunk Core Certified User Certification

Yes

No

dc(field)

count(field)

count-by(field)

distinct-count(field)

8089

8000

8080

443

a base search for the object

fields for the object

earliest=

latest=

beginning=

ending=

All the above

Only 3rd and 4th

inputlookup

lookup

Not possible to specify time manually in Search query

end=

start=

earliest=

latest=

count stats vendor_action

count stats (vendor_action)

stats count (vendor_action)

stats vendor_action (count)

| rename action = CustomerAction

| rename Action as “Customer Action”

| rename Action to “Customer Action”

| rename action as “Customer Action”

A field that appears in any event

A field that appears in every event

A field that appears in the top 10 events

A field that appears in at least 20% of the events

OR

AND

NOT

NAND

lookup command

inputlookup command

Settings > Lookups > Input

Settings > Lookups > Upload

User

Alerting

Power

Admin

No

Yes

False

True

True

False

Only HTTP Event Collector (HEC) and TCP/UDP

None of the above

Only TCP/UDP

Only Scripts

Filed & Directories, HTTP Event Collector (HEC), TCP/UDP and Scripts

The owner of the report can edit permissions from the Edit dropdown

Only users with an Admin or Power User role can access other users' reports

Anyone can access any reports marked as public within a shared Splunk deployment

The owner of the report must clone the original report and save it to their user account

Both field names and field values ARE case sensitive.

Field names ARE case sensitive; field values are NOT.

Field values ARE case sensitive; field names ARE NOT.

Both field names and field values ARE NOT case sensitive.

Your search must transform event data into Excel file format first.

Your search must transform event data into XML formatted data first.

Your search must transform event data into statistical data tables first.

Your search must transform event data into JSON formatted data first.

Correlated

File-based

Total

Segmented

the_questionnaire _pedia

the_questionnaire pedia

the_questionnaire_pedia

the_questionnaire Pedia

index

action

_time

host

sourcetype=firewall | rare num=15 dest_ip

sourcetype=firewall | rare last=15 dest_ip

sourcetype=firewall | rare count=15 dest_ip

sourcetype=firewall | rare limit=15 dest_ip

Review Splunk reports

Run ./splunk show

Click Data Summary in Splunk Web

Search index=* sourcetype=* host=*

OR

NOT

AND

XOR

Add an output.

Export a dashboard panel.

Modify the chart type displayed in a dashboard panel.

Drag a dashboard panel to a different location on the dashboard.

When Splunk encounters a syntax error in a search

When a trigger action meets the predefined conditions

When an event in a search matches up with a data model

When results of a search meet a specifically defined condition

| rare top=5

| top rare=5

| top limit=5

| rare limit=5

Only HF

No

Yes

Source type

At least five columns

Timestamp

Input filed

True

False

Real-time searches happen instantly, while relative searches happen at a scheduled time.

Real-time searches display results from a rolling time window, while relative searches display results from a set length of time.

Real-time searches run constantly in the background, while relative searches only run when certain criteria are met.

Real-time represents events that have happened in a set time window, while relative will display results from a rolling time window.

A number to the right of the field name.

A # symbol to the left of the field name.

A lowercase n to the left of the field name.

A lowercase n to the right of the field name.

count, sum, add

count, sum, less

sum, avg, values

sum, values, table

No

Yes

Built only by Splunk employees.

A collection of files.

Only available for download on Splunkbase.

Available on iOS and Android.

CTRL + Enter

Shift + Enter

Space + Enter

ALT + Enter

Zoom to selection: Narrows the time range and re-executes the search.

Zoom to selection: Narrows the time range and doesn't re-executes the search.

Format Timeline: Hides or shows the timeline in different views.

Zoom-Out: Expands the time focus and doesn't re-executes the search.

Zoom-out: Expands the time focus and re-executes the search.

action

clientip

categoryld

sourcetype

Returns the least common field values of a given field in the results.

Returns the most common field values of a given field in the results.

Returns the top 10 field values of a given field in the results.

Returns the lowest 10 field values of a given field in the results.

Filter as early as possible.

Never specify more than one index.

Include as few search terms as possible.

Use wildcards to return more search results.

3

2

4

1

Only continuous monitoring.

Only One-time monitoring.

None of the above.

Both One-time and continuous monitoring

Only data where the error field is present and does not contain a value will be displayed.

Only data with a value in the field error will be displayed.

Only data that does not contain the error field will be displayed.

Only data where the value of the field error does not equal an asterisk (*) will be displayed.

Indexing

Searching

Parsing

Settings

Input

Include all formatting commands before any search terms

Include at least one function as this is a search requirement

Include the search terms at the beginning of the search string

Avoid using formatting clauses as they add too much overhead

Can be accessed by Apps > Search & Reporting.

Provides default interface for searching and analyzing logs.

Enables the user to create knowledge object, reports, alerts and dashboards.

It only gives us search functionality.

No

Yes

An app

JSON

A role

An enhanced solution

True

False

f*il

*fail

fail*

*fail*

True

False

After saving the report, click Schedule.

After saving the report, click Event Type.

After saving the report, click Scheduling.

After saving the report, click Dashboard Panel.

True

False

Yes

No

sourcetype

index

source

host

Saving the item to a report

Adding the item to the search.

Adding the item to a dashboard

Saving the search to a JSON file.

Will return event where status field exist but value of that field is not 100.

Will return event where status field exist but value of that field is not 100 and all events where status field

doesn't exist.

Will get different results depending on data

(index=netfw failure) AND index=netops warn OR critical

(index=netfw failure) OR (index=netops (warn OR critical))

(index=netfw failure) AND (index=netops (warn OR critical))

(index=netfw failure) OR index=netops OR (warn OR critical)

It returns the top 10 results

It displays the output in table format

It returns the count and percent columns per row

All of the above

True

False

time

_time

EventTime

timestamp

Forwarders

Deployment Server

Indexer

Knowledge Objects

Index

Search Head

The lookup must be configured to run automatically.

The contents of the lookup file must be copied and pasted into the search bar.

The lookup file must be uploaded to Splunk and a lookup definition must be created.

The lookup file must be uploaded to the etc/apps/lookups folder for automatic ingestion.

Designed to cater numerous use cases and empower Splunk.

We can not install Splunk App.

Allows multiple workspaces for different use cases/user roles.

It is collection of different Splunk config files like data inputs, UI and Knowledge Object.

Red

Blue

Orange

Highlighted

True

False