SPLK-1001 questions with correct answers

What must be done before an automatic lookup can be created? (Choose all that apply.) A. The lookup command must be used. B. The lookup definition must be created. C. The lookup file must be uploaded to Splunk. D. The lookup file must be verified using the inputlookup command. CORRECT ANSWER B Which of the following searches would return events with failure in index netfw or warn or critical in index netops? A . (index=netfw failure) AND index=netops warn OR critical B . (index=netfw failure) OR (index=netops (warn OR critical)) C . (index=netfw failure) AND (index=netops (warn OR critical)) D . (index=netfw failure) OR index=netops OR (warn OR critical) CORRECT ANSWER B When editing a dashboard, which of the following are possible options? (Choose all that apply.) A . Add an output. B . Export a dashboard panel. C . Modify the chart type displayed in a dashboard panel. D . Drag a dashboard panel to a different location on the dashboard. CORRECT ANSWER C, D Which of the following represents the Splunk recommended naming convention for dashboards?