Splunk Certified Developer SPLK-2001 Exam Questions

1. Suppose the following query in a Simple XML dashboard returns a table including hyperlinks:

<search>

<query>index news sourcetype web_proxy | table sourcetype title link </query>

</search>

Which of the following is a valid dynamic drilldown element to allow a user of the dashboard to visit the hyperlinks contained in the link field?

2. When updating a knowledge object via REST, which of the following are valid values for the sharing Access Control List property?

3. Which of the following are ways to get a list of search jobs? (Select all that apply.)

4. Which of the following are benefits from using Simple XML Extensions? (Select all that apply.)

5. How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)

6. After updating a dashboard in myApp, a Splunk admin moves myApp to a different Splunk instance. After logging in to the new instance, the dashboard is not seen.

What could have happened? (Select all that apply.)

7. Which of the following statements define a namespace?

8. Which of the following are characteristics of an add-on? (Select all that apply.)

9. Which of the following statements describe oneshot searches? (Select all that apply.)

10. Which of the following options would be the best way to identify processor bottlenecks of a search?

11. Which of the following is true of a namespace?

12. What must be done when calling the serviceNS endpoint?

13. Assuming permissions are set appropriately, which REST endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role?

14. Using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in which directory?

15. What application security best practices should be adhered to while developing an app for Splunk? (Select all that apply.)

16. There is a global search named “global_search” defined on a form as shown below:

<search id=“global_search”>

<query>

index-_internal source-*splunkd.log | stats count by component, log_level

</query>

</search>

Which of the following would be a valid post-processing search? (Select all that apply.)

17. In order to successfully accelerate a report, which criteria must the search meet? (Select all that apply.)

18. Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

19. Which type of command is tstats?

20. Which of the following is an example of a Splunk KV store use case? (Select all that apply.)