Splunk core certified user exam Questions with Detailed Verified Answers

Page | 1



Splunk core certified user exam
Questions with Detailed Verified
Answers

Question:Which of the statements is correct regarding click and drag option
in timeline?


Ans: The new result after selecting the range by dragging filters the events
and displays the most recent first


Question: Which of the statements are correct?


Ans: Zoom to selection: Narrows the time range and re-executes the search.


Format Timeline: Hides or shows the timeline in different views


Zoom-out: Expands the time focus and re-executes the search


Question: The default host name used in Inputs general settings can not be
changed.


Ans: False


Question: You can use the following options to specify start and end time for
the query range:

, Page | 2

Ans: earliest=


latest=


Question: Zoom Out and Zoom to Selection re-executes the search


Ans: True


Question: Search Assistant is enabled by default in the SPL editor with
compact settings.


Ans: True


Question: Where does Licensing meter happen?


Ans: Indexer


Question: Upload option creates inputs.conf


Ans: False


Question: In monitor option you can select the following options in GUI.


Ans: Filed & Directories, HTTP Event Collector (HEC), TCP/UDP and Scripts


Question: You can on-board data to Splunk using following means

, Page | 3

Ans: CLI


Splunk Web


Splunk apps and add-ons


inputs.conf


Question: Data sources being opened and read applies to


Ans: Input Phase


Question: Which of the following statements are correct about Search &
Reporting App?


Ans: Can be accessed by Apps > Search & Reporting.


Provides default interface for searching and analyzing logs.


Enables the user to create knowledge object, reports, alerts and dashboards.


Question: Monitor option in Add Data provides


Ans: Both One-time and continuous monitoring


Question: License Meter runs before data compression


Ans: True


Question: Which of the following are Splunk premium enhanced solutions?