What must be done before an automatic lookup can be created? (select all that apply)

The lookup definition must be created.

The lookup command must be used.

The lookup definition must be created.

The lookup file must be uploaded to Splunk.

The lookup file must be verified using the inputlookup command.

How can search results be kept longer than 7 days?

By changing the time range picker to more than 7 days.

Which of the following is a Splunk search best practice?

Never specify more than one index.

Include as few search terms as possible.

Use wildcards to return more search results.

How are events displayed after a search is executed?

In reverse chronological order.

Alphabetically according to field name.

After running a search, what effect does clicking and dragging across the timeline have?

Filters current search results.

Moves to past or future events.

Expands the time range of the search.

Which time range picker configuration would return real-time events for the past 30 seconds?

Real-time - Earliest: 30-seconds ago, Latest: Now

Preset - Relative: 30-seconds ago

Relative - Earliest: 30-seconds ago, Latest: Now

Real-time - Earliest: 30-seconds ago, Latest: Now

Advanced - Earliest: 30-seconds ago, Latest: Now

What is one benefit of creating dashboard panels from reports?

It makes the dashboard more efficient because it only has to run one search string.

Any newly created dashboard will include that report.

There are no benefits to creating dashboard panels from reports.

It makes the dashboard more efficient because it only has to run one search string.

Any change to the underlying report will affect every dashboard that utilizes that report.

Which of the following statements about case sensitivity is true?

Field names ARE case sensitive; field values are NOT.

Both field names and field values ARE case sensitive.

Field names ARE case sensitive; field values are NOT.

Field values ARE case sensitive; field names ARE NOT.

Both field names and field values ARE NOT case sensitive.

What does the rare command do?

Returns the least common field values of a given field in the results.

Returns the most common field values of a given field in the results.

Returns the top 10 field values of a given field in the results.

Returns the lowest 10 field values of a given field in the results.

What does the values function of the stats command do?

Lists unique values of a given field.

Lists all values of a given field.

Lists unique values of a given field.

Returns a count of unique values for a given field.

Returns the number of events that match the search.

A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?

Click All Fields and select the field to add it to Selected Fields.

Click Interesting Fields and select the field to add it to Selected Fields.

Click Selected Fields and select the field to add it to Interesting Fields.

This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.

How does Splunk determine which fields to extract from data?

Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data.

Splunk only extracts the most interesting data from the last 24 hours.

Splunk only extracts fields users have manually specified in their data.

Splunk automatically extracts any fields that generate interesting visualizations.

Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data.

Which search string returns a filed containing the number of matching events and names that field Event Count?

index=security failure | stats count as "Event Count"

index=security failure | stats sum as "Event Count"

index=security failure | stats count as "Event Count"

index=security failure | stats count by "Event Count"

index=security failure | stats dc(count) as "Event Count"

When looking at a statistics table, what is one way to drill down to see the underlying events?

Clicking on the visualizations tab.

Viewing your report in a dashboard.

Clicking on any field value in the table.

In the fields sidebar, what indicates that a field is numeric?

A # symbol to the left of the field name.

A number to the right of the field name.

A # symbol to the left of the field name.

A lowercase n to the left of the field name.

A lowercase n to the right of the field name.

What is the primary use for the rare command?

To find the least common values of a field in a dataset.

To sort field values in descending order.

To return only fields containing five of fewer values.

To find the least common values of a field in a dataset.

To find the fields with the fewest number of values across a dataset.

Splunk SPLK-1001 Practice Test 3 - Free Online Exam Prep & Questions

Creating Data Models:

Fields associated with a data set are known as ______.

Attributes

Constraints

Comment (0)

Splunk SPLK-1001 Practice Test 3

Question

Splunk SPLK-1001 Practice Tests

Practice Tests