Which statement is true about the top command?

It displays the output in table format

It returns the count and percent columns per row

What determines the scope of data that appears in a scheduled report?

The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.

All data accessible to the User role will appear in the report.

All data accessible to the owner of the report will appear in the report.

All data accessible to all users will appear in the report until the next time the report is run.

The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.

What is the main requirement for creating visualizations using the Splunk UI?

Your search must transform event data into statistical data tables first.

Your search must transform event data into Excel file format first.

Your search must transform event data into XML formatted data first.

Your search must transform event data into statistical data tables first.

Your search must transform event data into JSON formatted data first.

How can another user gain access to a saved report?

The owner of the report can edit permissions from the Edit dropdown

Only users with an Admin or Power User role can access other users' reports

Anyone can access any reports marked as public within a shared Splunk deployment

The owner of the report must clone the original report and save it to their user account

What is the primary use for the rare command1?

To find the least common values of a field in a dataset

To sort field values in descending order

To return only fields containing five or fewer values

To find the least common values of a field in a dataset

To find the fields with the fewest number of values across a dataset

What happens when a field is added to the Selected Fields list in the fields sidebar'?

The selected field and its corresponding values will appear underneath the events in the search results

Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field

Splunk will highlight related fields as a suggestion to add them to the Selected Fields list.

Custom selections will replace the Interesting Fields that Splunk populated into the list at search time

The selected field and its corresponding values will appear underneath the events in the search results

Which of the following describes lookup files?

Lookups contain static data available in the index

Lookup fields cannot be used in searches

Lookups contain static data available in the index

Lookups add more fields to results returned by a search

Lookups pull data at index time and add them to search results

How do you add or remove fields from search results?

Use fields +to add and fields –to remove.

Use field +to add and field -to remove.

Use table +to add and table -to remove.

Use fields +to add and fields –to remove.

Use fields Plus to add and fields Minus to remove.

What are the steps to schedule a report?

After saving the report, click Schedule.

After saving the report, click Event Type.

After saving the report, click Scheduling.

After saving the report, click Dashboard Panel.

What is a primary function of a scheduled report?

Triggering an alert in your Splunk instance when certain conditions are met

Auto-detect changes in performance

Auto-generated PDF reports of overall data trends

Regularly scheduled archiving to keep disk space use low

Triggering an alert in your Splunk instance when certain conditions are met

Which search string is the most efficient?

index=security "failed password"

Which search string matches only events with the status_code of 4:4?

status code>403 status_code<405

Which of the following commands will show the maximum bytes?

sourcetype=access_* | stats max(bytes)

sourcetype=access_* | maximum totals by bytes

sourcetype=access_* | avg (bytes)

sourcetype=access_* | stats max(bytes)

sourcetype=access_* | max(bytes)

Which of the following searches will show the number of categoryld used by each host?

Sourcetype=access_* |stats sum(categorylD) by host

Sourcetype=access_* |sum bytes by host

Sourcetype=access_* |stats sum(categorylD) by host

Sourcetype=access_* |sum(bytes) by host

Sourcetype=access_* |stats sum by host

Clicking a SEGMENT on a chart, ________.

adds the highlighted value to the search criteria

highlights the field value across the chart

adds the highlighted value to the search criteria

What is the correct order of steps for creating a new lookup?

Configure the lookup to run automatically

The command shown here does witch of the following: Command: |outputlookup products.csv

Writes search results to a file named products.csv

Returns the contents of a file named products.csv

Which of the following are not true about lookups? (Select all that apply.)

Search results can be used to populate a lookup tableC .Splunk DB Connect can be used to populate a lookup table from relational databases

Output from a script can be used to populate a lookup table

Lookup have a 10mg maximum size limit

Splunk SPLK-1001 Practice Test 2 - Free Online Exam Prep & Questions

At index time, in which field does Splunk store the timestamp value?

time

_time

EventTime

timestamp

Comment (0)

Splunk SPLK-1001 Practice Test 2

Question

Splunk SPLK-1001 Practice Tests

Practice Tests