SPLK-1001 exam

Which of the following are common constraints of the top command?A . limit, countB . limit, showpercentC . limits, countfieldD . showperc, countfieldView AnswerAnswer: A

What must be done in order to use a lookup table in Splunk?A . The lookup must be configured to run automatically.B . The contents of the lookup file must be copied and pasted into the search bar.C . The lookup file must be uploaded to Splunk and a lookup...

How can search results be kept longer than 7 days?A . By scheduling a report.B . By creating a link to the job.C . By changing the job settings.D . By changing the time range picker to more than 7 days.View AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Extendjoblifetimes

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by priceA . index=security sourcetype=access_* status=200 stats | count by priceB . index=security sourcetype=access_* status=200 | stats count by priceC . index=security sourcetype=access_* status=200 | stats count | by...

Which command is used to review the contents of a specified static lookup file?A . lookupB . csvlookupC . inputlookupD . outputlookupView AnswerAnswer: C

Which of the following Splunk components typically resides on the machines where data originates?A . IndexerB . ForwarderC . Search headD . Deployment serverView AnswerAnswer: C

Which of the following is a Splunk search best practice?A . Filter as early as possible.B . Never specify more than one index.C . Include as few search terms as possible.D . Use wildcards to return more search results.View AnswerAnswer: A

When writing searches in Splunk, which of the following is true about Booleans?A . They must be lowercase.B . They must be uppercase.C . They must be in quotations.D . They must be in parentheses.View AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Booleanexpressions

When displaying results of a search, which of the following is true about line charts?A . Line charts are optimal for single and multiple series.B . Line charts are optimal for single series when using Fast mode.C . Line charts are optimal for multiple series with 3 or more columns.D...

Which of the following searches would return events with failure in index netfw or warn or criticalin index netops?A . (index=netfw failure) AND index=netops warn OR criticalB . (index=netfw failure) OR (index=netops (warn OR critical))C . (index=netfw failure) AND (index=netops (warn OR critical))D . (index=netfw failure) OR index=netops OR (warn...