Splunk Core User SPLK-1001 Practice Questions & Answers • ExamPrepare

Question 1

In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?

No events will be returned.
Splunk will prompt you to specify an index.
All non-indexed events to which the user has access will be returned.
Events from every index searched by default to which the user has access will be returned.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

What is a quick, comprehensive way to learn what data is present in a Splunk deployment? Review Splunk reports Click Data Summary in Splunk Web

What is a quick, comprehensive way to learn what data is present in a Splunk deployment?

Review Splunk reports

Click Data Summary in Splunk Web

Review Splunk reports
Run ./splunk show
Click Data Summary in Splunk Web
Search index=* sourcetype=* host=*

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

What is a quick, comprehensive way to learn what data is present in a Splunk deployment?

Review Splunk reports
Run ./splunk show
Click Data Summary in Splunk Web
Search index=* sourcetype=* host=*

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

What is the primary use for the rare command?

To sort field values in descending order.
To return only fields containing five or fewer values.
To find the least common values of a field in a dataset.
To find the fields with the fewest number of values across a dataset.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

Use earliest=-1d@d latest=@d

Which of the following is the best way to create a report that shows the last 24 hours of events?

Use the time range picker to select "Yesterday".

Set a real-time search over a 24-hour window.

Use the time range picker to select "Last 24 hours".

Use earliest=-1d@d latest=@d
Set a real-time search over a 24-hour window.
Use the time range picker to select "Yesterday".
Use the time range picker to select "Last 24 hours".

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Which of the following searches would return only events that match the following criteria? ● Events are inside the main index ● The field status exists

in the event ● The value in the status field does not equal 200

index==main status!==200
index=main NOT status=200
index=main status!=200
index==main NOT status==200

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.