SPLK-1001

What syntax is used to link key/value pairs in search strings?A . ParenthesesB . @ or # symbolsC . Quotation marksD . Relational operators such as =, <, or >View AnswerAnswer: D

Which of the following searches would return events with failure in index netfw or warn or critical in index netops?A . (index=netfw failure) AND index=netops warn OR criticalB . (index=netfw failure) OR (index=netops (warn OR critical))C . (index=netfw failure) AND (index=netops (warn OR critical))D . (index=netfw failure) OR index=netops OR...

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by priceA . index=security sourcetype=access_* status=200 stats | count by priceB . index=security sourcetype=access_* status=200 | stats count by priceC . index=security sourcetype=access_* status=200 | stats count | by...

Which of the following are functions of the stats command?A . count, sum, addB . count, sum, lessC . sum, avg, valuesD . sum, values, tableView AnswerAnswer: C

What must be done in order to use a lookup table in Splunk?A . The lookup must be configured to run automatically.B . The contents of the lookup file must be copied and pasted into the search bar.C . The lookup file must be uploaded to Splunk and a lookup...

When writing searches in Splunk, which of the following is true about Booleans?A . They must be lowercase.B . They must be uppercase.C . They must be in quotations.D . They must be in parentheses.View AnswerAnswer: B

Which of the following index searches would provide the most efficient search performance?A . index=*B . index=web OR index=s*C . (index=web OR index=sales)D . *index=sales AND index=web*View AnswerAnswer: B

At index time, in which field does Splunk store the timestamp value?A . timeB . _timeC . EventTimeD . timestampView AnswerAnswer: B Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/HowSplunkextractstimestamps

Which of the following is the most efficient filter for running searches in Splunk?A . TimeB . Fast modeC . SourcetypeD . Selected FieldsView AnswerAnswer: C

What is a primary function of a scheduled report?A . Auto-detect changes in performance.B . Auto-generated PDF reports of overall data trends.C . Regularly scheduled archiving to keep disk space use low.D . Triggering an alert in your Splunk instance when certain conditions are met.View AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Report/Schedulereports