[18-Sep-2020] New 2020 Splunk Core Certified User SPLK-1001 Exam Questions (Update Questions)

1. Which Field/Value pair will return only events found in the index named security?

Index=Security

index=Security

Index=security

index!=Security

2. Which statement describes field discovery at search time?

Splunk automatically discovers only numeric fields

Splunk automatically discovers only alphanumeric fields

Splunk automatically discovers only manually configured fields

Splunk automatically discovers only fields directly related to the search results

3. What are the three main Splunk components?

Search head, GPU, streamer

Search head, indexer, forwarder

Search head, SQL database, forwarder

Search head, SSD, heavy weight agent

4. When is an alert triggered?

When Splunk encounters a syntax error in a search

When a trigger action meets the predefined conditions

When an event in a search matches up with a data model

When results of a search meet a specifically defined condition

5. Which search will return the 15 least common field values for the dest_ip field?

sourcetype=firewall | rare num=15 dest_ip

sourcetype=firewall | rare last=15 dest_ip

sourcetype=firewall | rare count=15 dest_ip

sourcetype=firewall | rare limit=15 dest_ip

6. What is the default lifetime of every Splunk search job?

All search jobs are saved for 10 days

All search jobs are saved for 10 hours

All search jobs are saved for 10 weeks

All search jobs are saved for 10 minutes

7. In the Fields sidebar, what does the number directly to the right of the field name indicate?

The value of the field

The number of values for the field

The number of unique values for the field

The numeric non-unique values of the field

8. How can results from a specified static lookup file be displayed?

lookupcommand

inputlookupcommand

Settings > Lookups > Input

Settings > Lookups > Upload

9. When is the pipe character, I, used in search strings?

Before clauses. For example: stats sum(bytes) | by host

Before commands. For example: | stats sum(bytes) by host

Before arguments. For example: stats sum| (bytes) by host

Before functions. For example: stats |sum(bytes) by host

10. Which of the following is the best way to create a report that shows the last 24 hours of events?

Use [email protected] [email protected]

Set a real-time search over a 24-hour window

Use the time range picket to select “Yesterday”

Use the time range picker to select “Last 24 hours”

11. What are the two most efficient search filters?

_time and host

_time and index

host and sourcetype

indexand sourcetype

12. Which of the following is a metadata field assigned to every event in Splunk?

host

owner

bytes

action

13. Assuming a user has the capability to edit reports, which of the following are editable?

Acceleration, schedule, permissions

The report’s name, schedule, permissions

The report’s name, acceleration, schedule

The report’s name, acceleration, permissions

14. What is a quick, comprehensive way to learn what data is present in a Splunk deployment?

Review Splunk reports

Run ./splunk show

Click Data Summary in Splunk Web

Search index=* sourcetype=* host=*

15. When viewing results of a search job from the Activity menu, which of the following is displayed?

New events based on the current time range picker

The same events based on the current time range picker

The same events from when the original search was executed

New events in addition to the same events from the original search

16. Which of the following is a correct way to limit search results to display the 5 most common values of a field?

| rare top=5

| top rare=5

| top limit=5

| rare limit=5

17. Which of the following is the most efficient search?

index=* “failed password”

“failed password” index=*

(index=* OR index=security) “failed password”

index=security “failed password”

18. Which command will rename action to Customer Action?

| rename action = CustomerAction

| rename Action as “Customer Action”

| rename Action to “Customer Action”

| rename action as “Customer Action”

19. Which of the following is a Splunk internal field?

_raw

host

_host

index

20. What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

latest=-2h

earliest=-2h

[email protected]

Leave a Reply Cancel reply