Splunk - Intro to Splunk Questions and Answers with Verified Solutions

Splunk - Intro to Splunk Questions and Answers with Verified Solutions Which search mode behaves differently depending on the type of search being run? (A) Fast (B) variable (C) Smart (D) Verbose (C) Smart Which character is used in a search before a command? (A) A pipe (|) (B) A backtick (`) (C) A tilde (~) (D) A quotation mark (") (A) A pipe (|) Which of the following searches will return results containing the terms failed, password, or failed password? (A) failed OR password (B) failed password OR "failed password" (C) fail* (D) failed OR password OR "failed password" (A) failed OR password (D) failed OR password OR "failed password" What are the default roles in Splunk Enterprise? (A) Admin (B) Power (C) Manager (D) User (A) Admin (B) Power (D) User Which command can be used to further filter results in a search? (A) Search (B) Subset (C) Filter (D) Subsearch (A) Search What determines the timestamp shown on returned events in a search? (A) Timestamps are displayed in Greenwich Mean Time (B) Timestamps are displayed in epoch time (C) The time zone where the event originated (D) The time zone defined in user settings (D) The time zone defined in user settings By default, how long does a search job remain active? (A) 7 days (B) 30 minutes (C) 10 minutes (C) 10 minutes When a search is run, in what order are events returned? (A) Reverse chronological order (B) Reverse alphanumeric order (C) Chronological order (D) Alphanumeric order (A) Reverse chronological order What is the most efficient way to limit search results returned? (A) index (B) time (C) host (D) source (B) time By default, which of the following roles are required to share knowledge objects? (A) Power (B) Admin (C) Manager (D) User (A) Power (B) Admin Which Splunk infrastructure component stores ingested data? (A) Datasets (B) Data models (C) Dashboards (D) Index (D) Index By default, who is able to view a saved report? (A) The user who created it (B) Any user with a power or admin role (C) Any user with a power or admin role (D) Any user with the viewreports capability (A) The user who created it Which of the following searches will return results containing the phrase "failed password"? (A) "failed password" (B) failed password (C) `failed password` (D) (failed password) (A) "failed password" Which of the following searches will return results containing the words fail, failure, or failed? (A) fail+ (B) *fail (C) fail (D) fail* (D) fail* Which of the following booleans can be used in a search? (A) ALSO (B) NOT (C) AND (D) OR (B) NOT (C) AND (D) OR