SPLK-1001 Exam Questions

Select the best options for "search best practices" in Splunk: (Choose five.)

The better way of writing search query for index is:

Put query into separate lines where | (Pipes) are used by selecting following options.

Fields are searchable key value pairs in your event data.

Selected fields are a set of configurable fields displayed for each event.

Following are the time selection option while making search: (Choose all that apply.)

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Which of the following statements describes a search job?

Which search will return only events containing the word "error" and display the results as a table that includes the fields named action, src, and dest?

Which of the following reports is available in the Fields window?

In the Search and Reporting app, which tab displays timecharts and bar charts?

What will always appear in the Selected Fields list?

What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

Which of the following is a Splunk internal field?

Which command will rename action to Customer Action?

How can results from a specified static lookup file be displayed?

In the Fields sidebar, what does the number directly to the right of the field name indicate?

What is the default lifetime of every Splunk search job?

Which search will return the 15 least common field values for the dest_ip field?

When is an alert triggered?

What are the three main Splunk components?

Which statement describes field discovery at search time?

Which Field/Value pair will return only events found in the index named security?

Which of the following searches would return only events that match the following criteria? - Events are inside the main index - The field status exists in the event - The value in...

Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip

Which Field/Value pair will return only events found in the index named security?

How many minutes, by default, is the time to live (ttl) for an ad-hoc search job?

When using the top command in the following search, which of the following will be true about the results? index="main" sourcetype="access_*" action="purchase" | top 3 statusCode b...

By default, which role contains the minimum permissions required to have write access to Splunk alerts?

In the Search and Reporting app, which is a default selected field?

Which of the following is an accurate definition of fields within Splunk?

The four types of Lookups that Splunk provides out-of-the-box are External, KV Store, Geospatial and which of the following?

When refining search results, what is the difference in the time picker between real-time and relative time ranges?

Which of the following is the best description of Splunk Apps?

What is the proper SPL terminology for specifying a particular index in a search?

Which of the following is the appropriately formatted SPL search?

How are the results of the following search sorted? ... | sort action, --file, +bytes

Splunk users are assigned roles. Which of the following do roles determine?

Which of the following is a false statement about Splunk dashboards?

What is the result of the following search? index=myindex source=c:\mydata. txt NOT error=*

What are Splunk alerts based on?

What is the correct syntax to count the number of events containing a vendor_action field?

By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

When looking at a dashboard panel that is based on a report, which of the following is true?

Which of the following is a best practice when writing a search string?

What type of search can be saved as a report?

What can be included in the All Fields option in the sidebar?

What syntax is used to link key/value pairs in search strings?

When viewing the results of a search, what is an Interesting Field?

What syntax is used to link key/value pairs in search strings?