SPLK-1001 exam

How do you add or remove fields from search results?A . Use field +to add and field -to remove.B . Use table +to add and table -to remove.C . Use fields +to add and fields Cto remove.D . Use fields Plus to add and fields Minus to remove.View AnswerAnswer: C

What is the correct syntax to count the number of events containing a vendor_action field?A . count stats vendor_actionB . count stats (vendor_action)C . stats count (vendor_action)D . stats vendor_action (count)View AnswerAnswer: C Explanation: The stats command calculates statistics based on fields in the events. The count function counts the...

What is a primary function of a scheduled report?A . Auto-detect changes in performanceB . Auto-generated PDF reports of overall data trendsC . Regularly scheduled archiving to keep disk space use lowD . Triggering an alert in your Splunk instance when certain conditions are metView AnswerAnswer: B

Which of the following searches would return events with failure in index netfw or warn or critical in index netops?A . (index=netfw failure) AND index=netops warn OR criticalB . (index=netfw failure) OR (index=netops (warn OR critical))C . (index=netfw failure) AND (index=netops (warn OR critical))D . (index=netfw failure) OR index=netops OR...

In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?A . No events will be returned.B . Splunk will prompt you to specify an index.C . All non-indexed events to which the user has access will...

What can be included in the All Fields option in the sidebar?A . DashboardsB . Metadata onlyC . Non-interesting fieldsD . Field descriptionsView AnswerAnswer: C

This search will return 20 results. SEARCH: error | top host limit = 20A . TrueB . FalseView AnswerAnswer: B

By default, all users have DELETE permission to ALL knowledge objects.A . TrueB . FalseView AnswerAnswer: B

Lookups allow you to overwrite your raw event.A . TrueB . FalseView AnswerAnswer: B

Which of the following fields is stored with the events in the index?A . userB . sourceC . locationD . sourcelpView AnswerAnswer: B