Which of the following statements describes a search job?

Once a search job begins, it can be stopped or paused at any point in time

Once a search job begins, it cannot be stopped

A search job can only be paused when less than 50% of events are returned

A search job can only be stopped when less than 50% of events are returned

Once a search job begins, it can be stopped or paused at any point in time

Which search will return only events containing the word "error" and display the results as a table that includes the fields named action, src, and dest?

error | stats table action, src, dest

error | table action, src, dest

error | tabular action, src, dest

error | stats table action, src, dest

error | table column=action column=src column=dest

Which command will rename action to Customer Action?

| rename action as "Customer Action"

| rename action = CustomerAction

| rename Action as "Customer Action"

| rename Action to "Customer Action"

| rename action as "Customer Action"

Which of the following is the most efficient search?

(index=* OR index=security) "failed password"

index=security "failed password"

When viewing results of a search job from the Activity menu, which of the following is displayed?

The same events from when the original search was executed

New events based on the current time range picker

The same events based on the current time range picker

The same events from when the original search was executed

New events in addition to the same events from the original search

What is a quick, comprehensive way to learn what data is present in a Splunk deployment?

Click Data Summary in Splunk Web

Search index=* sourcetype=* host=*

Assuming a user has the capability to edit reports, which of the following are editable?

The report's name, schedule, permissions

Acceleration, schedule, permissions

The report's name, schedule, permissions

The report's name, acceleration, schedule

The report's name, acceleration, permissions

Which of the following is the best way to create a report that shows the last 24 hours of events?

Use the time range picker to select "Last 24 hours"

Set a real-time search over a 24-hour window

Use the time range picket to select "Yesterday"

Use the time range picker to select "Last 24 hours"

When is the pipe character, I, used in search strings?

Before commands. For example: | stats sum(bytes) by host

Before clauses. For example: stats sum(bytes) | by host

Before commands. For example: | stats sum(bytes) by host

Before arguments. For example: stats sum| (bytes) by host

Before functions. For example: stats |sum(bytes) by host

In the Fields sidebar, what does the number directly to the right of the field name indicate?

The number of unique values for the field

The number of values for the field

The number of unique values for the field

The numeric non-unique values of the field

What is the default lifetime of every Splunk search job?

All search jobs are saved for 10 minutes

All search jobs are saved for 10 days

All search jobs are saved for 10 hours

All search jobs are saved for 10 weeks

All search jobs are saved for 10 minutes

Which search will return the 15 least common field values for the dest_ip field?

sourcetype=firewall | rare count=15 dest_ip

sourcetype=firewall | rare num=15 dest_ip

sourcetype=firewall | rare last=15 dest_ip

sourcetype=firewall | rare count=15 dest_ip

sourcetype=firewall | rare limit=15 dest_ip

When is an alert triggered?

When results of a search meet a specifically defined condition

When Splunk encounters a syntax error in a search

When a trigger action meets the predefined conditions

When an event in a search matches up with a data model

When results of a search meet a specifically defined condition

What are the three main Splunk components?

Search head, indexer, forwarder

Search head, SQL database, forwarder

Search head, SSD, heavy weight agent

Which statement describes field discovery at search time?

Splunk automatically discovers only fields directly related to the search results

Splunk automatically discovers only numeric fields

Splunk automatically discovers only alphanumeric fields

Splunk automatically discovers only manually configured fields

Splunk automatically discovers only fields directly related to the search results

When using the top command in the following search, which of the following will be true about the results?index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count

The top three most common values in statusCode will be displayed for each user.

The search will fail. The proper top command format is top limit=3 instead of top 3.

The top three most common values in statusCode will be displayed for each user.

Only the top three overall most common values in statusCode will be displayed.

The percentage field will be displayed in the results.

Which of the following is an accurate definition of fields within Splunk?

Inherent entities that exist in event data.

A searchable key/value pair in event data.

Values pulled exclusively from lookup tables.

A non-searchable name/value pair used while indexing data.

When refining search results, what is the difference in the time picker between real-time and relative time ranges?

Real-time searches display results from a rolling time window, while relative searches display results from a set length of time.

Real-time searches happen instantly, while relative searches happen at a scheduled time.

Real-time searches display results from a rolling time window, while relative searches display results from a set length of time.

Real-time searches run constantly in the background, while relative searches only run when certain criteria are met.

Real-time represents events that have happened in a set time window, while relative will display results from a rolling time window.

Which of the following is the best description of Splunk Apps?

Built only by Splunk employees.

Only available for download on Splunkbase.

Which of the following is the appropriately formatted SPL search?

index=security sourcetype=linux secure (invalid OR failed) | stats count as 'Potential Issues'

index=security sourcetype=linux secure (invalid OR failed) | stats as 'Potential Issues'

index---security sourcetype=linux secure (invalid OR failed) | count stats as 'Potential Issues'

index---security sourcetype=linux secure (invalid OR failed) | count as 'Potential Issues'

How are the results of the following search sorted?... | sort action, ---file, +bytes

In ascending order by action, then descending order by file, and lastly by ascending order of bytes.

In descending order by action, then descending order by file, and lastly by ascending order of bytes.

In ascending order by action, then descending order by file, and lastly by ascending order of bytes.

In descending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

In ascending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.