SPLK-1001 sample questions

Question 1

Parsing of data can happen both in HF and UF.

Accepted Answer

No

Answer

Yes

Question 2

Log filtering/parsing can be done from __________.

Accepted Answer

Heavy Forwarders (HF)

Answer

Index Forwarders (IF)

Answer

Universal Forwarders (UF)

Answer

Super Forwarder (SF)

Question 3

Splunk automatically determines the source type for major data types.

Accepted Answer

True

Answer

False

Question 4

Uploading local files though Upload options index the file only once.

Accepted Answer

Yes

Answer

No

Question 5

When displaying results of a search, which of the following is true about line charts?

Accepted Answer

Line charts are optimal for multiple series with 3 or more columns.

Answer

Line charts are optimal for single and multiple series.

Answer

Line charts are optimal for single series when using Fast mode.

Answer

Line charts are optimal for multiseries searches with at least 2 or more columns.

Question 6

Select the statements that are true for timeline in Splunk (Choose four.):

Accepted Answer

Timeline shows distribution of events specified in the time range in the form of bars.

Accepted Answer

Single click to see the result for particular time period.

Accepted Answer

You can click and drag across the bar for selecting the range.

Accepted Answer

You can hover your mouse for details like total events, time and date.

Answer

This is default view and you can't make any changes to it.

Question 7

Which of the following describes lookup files?

Accepted Answer

Lookups contain static data available in the index.

Answer

Lookup fields cannot be used in searches.

Answer

Lookups add more fields to results returned by a search.

Answer

Lookups pull data at index time and add them to search results.

Question 8

Which is primary function of the timeline located under the search bar?

Accepted Answer

To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime.

Answer

To differentiate between structured and unstructured events in the data.

Answer

To sort the events returned by the search command in chronological order.

Answer

To zoom in and zoom out, although this does not change the scale of the chart.

Question 9

Which of the following is a correct way to limit search results to display the 5 most common values of a field?

Accepted Answer

| top limit=5

Answer

| rare top=5

Answer

| top rare=5

Answer

| rare limit=5

Question 10

Put query into separate lines where | (Pipes) are used by selecting following options.

Accepted Answer

Shift + Enter

Answer

CTRL + Enter

Answer

Space + Enter

Answer

ALT + Enter

SPLK-1001 Sample Questions & Answers

Ready for the real thing?

SPLK-1001 Sample Questions & Answers

Related practice tests

Ready for the real thing?