Splunk Exam Questions – Complete and correct answers

Splunk Exam Questions – Complete and |\ |\ |\ |\ |\ |\




correct answers |\




Which search string only returns events from hostWWW3?
|\ |\ |\ |\ |\ |\ |\



- CORRECT ANSWERS ✔✔host=WW3
|\ |\ |\ |\




By default, how long does Splunk retain a search job? -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔10 minutes |\ |\ |\




What must be done before an automatic lookup can be
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



created? - CORRECT ANSWERS ✔✔The lookup definition
|\ |\ |\ |\ |\ |\ |\



must be created |\ |\




Which of the following Splunk components typically
|\ |\ |\ |\ |\ |\ |\



resides on the machines where data originates? -
|\ |\ |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔Forwarder |\ |\




What determines the scope of data that appears in a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



scheduled report? - CORRECT ANSWERS ✔✔The owner of |\ |\ |\ |\ |\ |\ |\ |\



the report can configure permissions so that the report
|\ |\ |\ |\ |\ |\ |\ |\ |\



uses either the User role or the owner's profile at run time
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\

,When writing searches in Splunk, which of the following is
|\ |\ |\ |\ |\ |\ |\ |\ |\



true about Booleans? - CORRECT ANSWERS ✔✔They
|\ |\ |\ |\ |\ |\ |\ |\



must be uppercase
|\ |\




Which of the following searches would return events with
|\ |\ |\ |\ |\ |\ |\ |\ |\



failure in index netfw or warn or critical in index netops? -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔(index=netfw failure) OR |\ |\ |\ |\ |\



(index=netops (warn OR critical)) |\ |\ |\




Select the answer that displays the accurate placing of
|\ |\ |\ |\ |\ |\ |\ |\ |\



the pipe in the following search string: index=security
|\ |\ |\ |\ |\ |\ |\ |\



sourcetype=access_* status=200 stats count by price - |\ |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔index=security |\ |\ |\



sourcetype=access_* status=200 | stats count by price |\ |\ |\ |\ |\ |\




Which of the following constraints can be used with the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



top command? - CORRECT ANSWERS ✔✔Limit
|\ |\ |\ |\ |\




When editing a dashboard, which of the following are
|\ |\ |\ |\ |\ |\ |\ |\ |\



possible options? - CORRECT ANSWERS ✔✔Modify the
|\ |\ |\ |\ |\ |\ |\



chart type displayed in a dashboard panel
|\ |\ |\ |\ |\ |\




Drag a dashboard panel to a different location on a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



dashboard

,When running searches, command modifiers in the search
|\ |\ |\ |\ |\ |\ |\



string are displayed in what colour? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\



✔✔Orange
|\




Which of the following represents the Splunk
|\ |\ |\ |\ |\ |\ |\



recommended naming convention for dashboards? - |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔Group_object_description
|\ |\




Which of the following in Splunk is best practice? -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔Filter as early as possible
|\ |\ |\ |\ |\ |\




When looking at a dashboard panel that is based on a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\



report, which of the following is true? - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\



ANSWERS ✔✔You cannot modify the search string in the
|\ |\ |\ |\ |\ |\ |\ |\ |\



panel, but you can change and configure the visualisation
|\ |\ |\ |\ |\ |\ |\ |\




Which of the following are common constraints of the top
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



command? - CORRECT ANSWERS ✔✔Showperc, countfield |\ |\ |\ |\ |\




When displaying results of a search, which of the
|\ |\ |\ |\ |\ |\ |\ |\ |\



following is true about line charts? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\



✔✔Line charts are optimal for single and multiple series
|\ |\ |\ |\ |\ |\ |\ |\




How are events displayed after a search is executed? -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔In reverse chronological order
|\ |\ |\ |\ |\

, Which of the following is true about user account settings
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



and preferences? - CORRECT ANSWERS ✔✔Full name,
|\ |\ |\ |\ |\ |\ |\



time zone, and default app can be defined by clicking the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\



login name in the Splunk bar
|\ |\ |\ |\ |\




What is a primary function of a scheduled report? -
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



CORRECT ANSWERS ✔✔Triggering an alert in your Splunk
|\ |\ |\ |\ |\ |\ |\ |\



instance when certain conditions are met|\ |\ |\ |\ |\




After running a search, what effect does clicking and
|\ |\ |\ |\ |\ |\ |\ |\ |\



dragging across the timeline have? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\



✔✔Filters current search results |\ |\ |\




Which command is used to review the contents of a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



specified static lookup file? - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\



✔✔Inputlookup


What must be done in order to use a lookup table in
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\



Splunk? - CORRECT ANSWERS ✔✔The lookup file must be
|\ |\ |\ |\ |\ |\ |\ |\ |\



uploaded to Splunk, and a lookup definition must be
|\ |\ |\ |\ |\ |\ |\ |\ |\



created


When sorting on multiple fields with the sort command,
|\ |\ |\ |\ |\ |\ |\ |\ |\



what delimiter can be used between the field names in
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



the search? - CORRECT ANSWERS ✔✔,
|\ |\ |\ |\ |\