SPLK-1001 Practice Questions

A.  

host

B.  

owner

C.  

bytes

D.  

action

A.  

index=a index=b

B.  

(index=a OR index=b)

C.  

index=(a & b)

D.  

index = a, b

A.  

Time

B.  

Fast mode

C.  

Sourcetype

D.  

Selected Fields

A.  

drills down for that value

B.  

highlights the field value across the chart

C.  

adds the highlighted value to the search criteria

A.  

2, 1, 3

B.  

1, 2, 3

C.  

2, 3, 1

D.  

3, 2, 1

A.  

It is only available to Admins.

B.  

Such feature does not exist in Splunk.

C.  

Shows options to complete the search string

A.  

sourcetype

B.  

index

C.  

source

D.  

host

A.  

To differentiate between structured and unstructured events in the data

B.  

To sort the events returned by the search command in chronological order

C.  

To zoom in and zoom out. although this does not change the scale of the chart

D.  

To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime

A.  

An app

B.  

JSON

C.  

A role

D.  

An enhanced solution

A.  

index=*

B.  

index=web OR index=s*

C.  

(index=web OR index=sales)

D.  

*index=sales AND index=web*