Splunk User Certification Exam With Correct Answers

SPLUNK USER CERTIFICATION EXAM
WITH CORRECT ANSWERS



5 Main components of Splunk ES - Correct Answers -Index Data, Search & investigate,
Add knowledge, Monitor & Alert, Report & Analyze.

Three main roles in splunk? (3) - Correct Answers -Admin, Power, User

Installs apps, creates knowledge objects for all users (what apps a user will see by
default) - Correct Answers -Admin

Creates and shares knowledge objects for users of app, real-time searches - Correct
Answers -Power User

Only sees own knowledge objects and those shared to them - Correct Answers -User

Apps in Splunk? - Correct Answers -1. Pre-built dashboards, reports, alerts and
workflows
2. In-depth data analysis for power users
3. Search & Reporting

What does the search and reporting app do in splunk? - Correct Answers -Creates
knowledge objects, reports, and dashboards

The seven main components in splunk searching and reporting? - Correct Answers -1.
Splunk bar
2. App bar
3. Search bar
4. Time range picker
5. How to search panel
6. What to search panel
7. Search History

What does the time range picker do? - Correct Answers -Allow search by preset times,
relative times. Real time (earliest, latest), date range. Retrieve events over a specific
time period.

Limiting search by ___________ is key to faster results and is a best practice - Correct
Answers –time

, | stats count(vendor_action) as ActionEvents, count as TotalEvents - Correct Answers -
Counts the number of events during the last 15 min that contain a vendor action field.
Also count total events

by {| stats count by user, app, vendor_action} - Correct Answers -The clause that, when
used with the stats command, returns a count for each value of a named field or set of
fields

distinct count(field) or dc(field) {| stats dc(s_hostname) as Websites} - Correct Answers
-Stats function that provides a count of how many unique values there are for a given
field in the result set

The time range picker is set to _________ by default. - Correct Answers -All-time

Search jobs are available for ____ minutes by default. - Correct Answers -10

________ commands create statistics and visualizations. - Correct Answers -
Transforming

________ tab is default tab for searches - Correct Answers -Event

The three main search modes? - Correct Answers -Fast, Verbose, and Smart

_______ mode has discovery off for event searches. No event or field data for stats
searches. - Correct Answers -Fast

______ mode has all events and field data; switches to this mode after visualization -
Correct Answers -Verbose

______ mode (default-based on search string data) has field discovery ON for event
searches. No event or field data for stats searches. - Correct Answers -Smart

What does the "Job V" action button do - Correct Answers -Edits job settings, sends
jobs to the background, inspects and deletes job.

Saved searches are set to ______ by default. - Correct Answers -private

Timestamp seen in events is based on______setting in user account profile - Correct
Answers -time zone

List the three booleans - Correct Answers -AND OR NOT

________boolean is used if none is implied - Correct Answers -AND

Exact phrases use______ - Correct Answers -quotes