SPLUNK USER CERTIFICATION EXAM
WITH CORRECT ANSWERS
5 Main components of Splunk ES - Correct Answers -Index Data, Search & investigate,
Add knowledge, Monitor & Alert, Report & Analyze.
Three main roles in splunk? (3) - Correct Answers -Admin, Power, User
Installs apps, creates knowledge objects for all users (what apps a user will see by
default) - Correct Answers -Admin
Creates and shares knowledge objects for users of app, real-time searches - Correct
Answers -Power User
Only sees own knowledge objects and those shared to them - Correct Answers -User
Apps in Splunk? - Correct Answers -1. Pre-built dashboards, reports, alerts and
workflows
2. In-depth data analysis for power users
3. Search & Reporting
What does the search and reporting app do in splunk? - Correct Answers -Creates
knowledge objects, reports, and dashboards
The seven main components in splunk searching and reporting? - Correct Answers -1.
Splunk bar
2. App bar
3. Search bar
4. Time range picker
5. How to search panel
6. What to search panel
7. Search History
What does the time range picker do? - Correct Answers -Allow search by preset times,
relative times. Real time (earliest, latest), date range. Retrieve events over a specific
time period.
Limiting search by ___________ is key to faster results and is a best practice - Correct
Answers –time
, | stats count(vendor_action) as ActionEvents, count as TotalEvents - Correct Answers -
Counts the number of events during the last 15 min that contain a vendor action field.
Also count total events
by {| stats count by user, app, vendor_action} - Correct Answers -The clause that, when
used with the stats command, returns a count for each value of a named field or set of
fields
distinct count(field) or dc(field) {| stats dc(s_hostname) as Websites} - Correct Answers
-Stats function that provides a count of how many unique values there are for a given
field in the result set
The time range picker is set to _________ by default. - Correct Answers -All-time
Search jobs are available for ____ minutes by default. - Correct Answers -10
________ commands create statistics and visualizations. - Correct Answers -
Transforming
________ tab is default tab for searches - Correct Answers -Event
The three main search modes? - Correct Answers -Fast, Verbose, and Smart
_______ mode has discovery off for event searches. No event or field data for stats
searches. - Correct Answers -Fast
______ mode has all events and field data; switches to this mode after visualization -
Correct Answers -Verbose
______ mode (default-based on search string data) has field discovery ON for event
searches. No event or field data for stats searches. - Correct Answers -Smart
What does the "Job V" action button do - Correct Answers -Edits job settings, sends
jobs to the background, inspects and deletes job.
Saved searches are set to ______ by default. - Correct Answers -private
Timestamp seen in events is based on______setting in user account profile - Correct
Answers -time zone
List the three booleans - Correct Answers -AND OR NOT
________boolean is used if none is implied - Correct Answers -AND
Exact phrases use______ - Correct Answers -quotes
WITH CORRECT ANSWERS
5 Main components of Splunk ES - Correct Answers -Index Data, Search & investigate,
Add knowledge, Monitor & Alert, Report & Analyze.
Three main roles in splunk? (3) - Correct Answers -Admin, Power, User
Installs apps, creates knowledge objects for all users (what apps a user will see by
default) - Correct Answers -Admin
Creates and shares knowledge objects for users of app, real-time searches - Correct
Answers -Power User
Only sees own knowledge objects and those shared to them - Correct Answers -User
Apps in Splunk? - Correct Answers -1. Pre-built dashboards, reports, alerts and
workflows
2. In-depth data analysis for power users
3. Search & Reporting
What does the search and reporting app do in splunk? - Correct Answers -Creates
knowledge objects, reports, and dashboards
The seven main components in splunk searching and reporting? - Correct Answers -1.
Splunk bar
2. App bar
3. Search bar
4. Time range picker
5. How to search panel
6. What to search panel
7. Search History
What does the time range picker do? - Correct Answers -Allow search by preset times,
relative times. Real time (earliest, latest), date range. Retrieve events over a specific
time period.
Limiting search by ___________ is key to faster results and is a best practice - Correct
Answers –time
, | stats count(vendor_action) as ActionEvents, count as TotalEvents - Correct Answers -
Counts the number of events during the last 15 min that contain a vendor action field.
Also count total events
by {| stats count by user, app, vendor_action} - Correct Answers -The clause that, when
used with the stats command, returns a count for each value of a named field or set of
fields
distinct count(field) or dc(field) {| stats dc(s_hostname) as Websites} - Correct Answers
-Stats function that provides a count of how many unique values there are for a given
field in the result set
The time range picker is set to _________ by default. - Correct Answers -All-time
Search jobs are available for ____ minutes by default. - Correct Answers -10
________ commands create statistics and visualizations. - Correct Answers -
Transforming
________ tab is default tab for searches - Correct Answers -Event
The three main search modes? - Correct Answers -Fast, Verbose, and Smart
_______ mode has discovery off for event searches. No event or field data for stats
searches. - Correct Answers -Fast
______ mode has all events and field data; switches to this mode after visualization -
Correct Answers -Verbose
______ mode (default-based on search string data) has field discovery ON for event
searches. No event or field data for stats searches. - Correct Answers -Smart
What does the "Job V" action button do - Correct Answers -Edits job settings, sends
jobs to the background, inspects and deletes job.
Saved searches are set to ______ by default. - Correct Answers -private
Timestamp seen in events is based on______setting in user account profile - Correct
Answers -time zone
List the three booleans - Correct Answers -AND OR NOT
________boolean is used if none is implied - Correct Answers -AND
Exact phrases use______ - Correct Answers -quotes
