Splunk Core Certified User Exam Questions and Correct Answers 100% Verified Graded
A+
Which of the following searches will return results containing the words fail, failure, or failed?
-fail*
-fail+
-*fail
-fail - -fail*
By default, which of the following roles are required to share knowledge objects?
-Power
-User
-Admin
-Manager - -Power
-Admin
By default, who is able to view a saved report?
-The user who created it
-Any user with a power or admin role
-Any user with the viewreports capability
-Any user with a power or admin role - -The user who created it
,Which of the following booleans can be used in a search?
-NOT
-OR
-AND
-ALSO - -NOT
-OR
-AND
Which character is used in a search before a command?}
A pipe (|)
A backtick (`)
A tilde (~)
A quotation mark (") - A pipe (|)
When a search is run, in what order are events returned?
-Chronological order
-Alphanumeric order
-Reverse alphanumeric order
,-Reverse chronological order - -Reverse chronological order
Which of the following searches will return results containing the phrase "failed password"?
-(failed password)
-failed password
-"failed password"
-`failed password` - -"failed password"
Which command can be used to further filter results in a search?
-subset
-filter
-subsearch
-search - -search
Which Splunk infrastructure component stores ingested data?
-Data models
-Index
-Datasets
-Dashboards - -Index
, By default, how long does a search job remain active?
-10 minutes
-30 minutes
-7 days - -10 minutes
Which search mode behaves differently depending on the type of search being run?
-Fast
-Verbose
-Smart
-Variable - -Smart
Which of the following searches will return results containing the terms failed, password, or
failed password?
-failed OR password OR "failed password"
-failed password OR "failed password"
-fail*
-failed OR password - -failed OR password OR "failed password"
-failed OR password
A+
Which of the following searches will return results containing the words fail, failure, or failed?
-fail*
-fail+
-*fail
-fail - -fail*
By default, which of the following roles are required to share knowledge objects?
-Power
-User
-Admin
-Manager - -Power
-Admin
By default, who is able to view a saved report?
-The user who created it
-Any user with a power or admin role
-Any user with the viewreports capability
-Any user with a power or admin role - -The user who created it
,Which of the following booleans can be used in a search?
-NOT
-OR
-AND
-ALSO - -NOT
-OR
-AND
Which character is used in a search before a command?}
A pipe (|)
A backtick (`)
A tilde (~)
A quotation mark (") - A pipe (|)
When a search is run, in what order are events returned?
-Chronological order
-Alphanumeric order
-Reverse alphanumeric order
,-Reverse chronological order - -Reverse chronological order
Which of the following searches will return results containing the phrase "failed password"?
-(failed password)
-failed password
-"failed password"
-`failed password` - -"failed password"
Which command can be used to further filter results in a search?
-subset
-filter
-subsearch
-search - -search
Which Splunk infrastructure component stores ingested data?
-Data models
-Index
-Datasets
-Dashboards - -Index
, By default, how long does a search job remain active?
-10 minutes
-30 minutes
-7 days - -10 minutes
Which search mode behaves differently depending on the type of search being run?
-Fast
-Verbose
-Smart
-Variable - -Smart
Which of the following searches will return results containing the terms failed, password, or
failed password?
-failed OR password OR "failed password"
-failed password OR "failed password"
-fail*
-failed OR password - -failed OR password OR "failed password"
-failed OR password
