Free Splunk Core Certified User Exam SPLK-1001 Exam Practice Test

______________ is the default web port used by Splunk.

• 8089
• 8000
• 8080
• 443

Keywords are highlighted when you mouse over search results and you can click this search result to (Choose three.):

• Open new search.
• Exclude the item from search.
• None of the above.
• Add the item to search

Which of the following commands will show the maximum bytes?

• sourcetype=access_* | maximum totals by bytes
• sourcetype=access_* | avg (bytes)
• sourcetype=access_* | stats max(bytes)
• sourcetype=access_* | max(bytes)

Fields are searchable name and value pairings that differentiates one event from another.

• False
• True

Which of the following can be used as wildcard search in Splunk?

• =
• >
• !
• *

The command shown here does witch of the following: Command: |outputlookup products.csv

• Writes search results to a file named products.csv
• Returns the contents of a file named products.csv

This search will return 20 results. SEARCH: error | top host limit = 20

• True
• False

Which Boolean operator is implied between search terms, unless otherwise specified?

• OR
• AND
• NOT
• NAND

NOT status = 100:

• Will display result depending on the data.
• Will return event where status field exist but value of that field is not 100.
• Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

Data summary button just below the search bar gives you the following (Choose three.):

• Hosts
• Sourcetypes
• Sources
• Indexes