Free Splunk Core Certified User Exam SPLK-1001 Exam Practice Test

Select the best options for 'search best practices' in Splunk:(Choose five.)

• Select the time range always.
• Try to specify index values.
• Include as many search terms as possible.
• Never select time range.
• Try to use * with every search term.
• Inclusion is generally better than exclusion.
• Try to keep specific search terms.

Which of the following is the best description of Splunk Apps?

• Built only by Splunk employees.
• A collection of files.
• Only available for download on Splunkbase.
• Available on iOS and Android.

The stats command will create a _____________ by default.

• Table
• Report
• Pie chart

What does the stats command do?

• Automatically correlates related fields
• Converts field values into numerical values
• Calculates statistics on data that matches the search criteria
• Analyzes numerical fields for their ability to predict another discrete field

Data sources being opened and read applies to:

• None of the above
• Indexing Phase
• Parsing Phase
• Input Phase
• License Metering

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following iscreated?

• Cloned panel
• Inline panel
• Report panel
• Prebuilt panel

When editing a dashboard, which of the following are possible options? (select all that apply)

• Add an output.
• Export a dashboard panel.
• Modify the chart type displayed in a dashboard panel.
• Drag a dashboard panel to a different location on the dashboard.

Which search string is the most efficient?

• 'failed password'
• ''failed password'*
• index=* 'failed password'
• index=security 'failed password'

What is the result of the following search?index=myindex source=c: \mydata. txt NOT error=*

• Only data where the error field is present and does not contain a value will be displayed.
• Only data with a value in the field error will be displayed.
• Only data that does not contain the error field will be displayed.
• Only data where the value of the field error does not equal an asterisk (*) will be displayed.

What is the correct order of steps for creating a new lookup?1. Configure the lookup to run automatically2. Create the lookup table3. Define the lookup

• 2, 1, 3
• 1, 2, 3
• 2, 3, 1
• 3, 2, 1