SPLUNK EXAM QUESTIONS AND
ANSWERS
To display the most common values in a specific field, what command would you use? -
Answer- top
Charts can be based on numbers, time, or location. - Answer- True
If a search returns this, you can view the results as a chart. - Answer- Statistical values
These roles can create reports: - Answer- Admin
User
Power
Finish the rename command to change the name of the status field to HTTP Status. -
Answer- status as "HTTP Status"
How many results are shown by default when using a Top or Rare Command? -
Answer- 10
_____________ are reports gathered together into a single pane of glass. - Answer-
Dashboards
In a dashboard, a time range picker will only work on panels that include a(n)
__________ search. - Answer- inline
Data models are made up of ___________. - Answer- Datasets
The instant pivot button is displayed in the statistics and visualization tabs when a
_______ search is run. - Answer- non-transforming
In most production environments, _______ will be used as your the source of data
input. - Answer- Forwarders
Splunk knows where to break the event, where the time stamp is located and how to
automatically create field value pairs using these. - Answer- Source types
ANSWERS
To display the most common values in a specific field, what command would you use? -
Answer- top
Charts can be based on numbers, time, or location. - Answer- True
If a search returns this, you can view the results as a chart. - Answer- Statistical values
These roles can create reports: - Answer- Admin
User
Power
Finish the rename command to change the name of the status field to HTTP Status. -
Answer- status as "HTTP Status"
How many results are shown by default when using a Top or Rare Command? -
Answer- 10
_____________ are reports gathered together into a single pane of glass. - Answer-
Dashboards
In a dashboard, a time range picker will only work on panels that include a(n)
__________ search. - Answer- inline
Data models are made up of ___________. - Answer- Datasets
The instant pivot button is displayed in the statistics and visualization tabs when a
_______ search is run. - Answer- non-transforming
In most production environments, _______ will be used as your the source of data
input. - Answer- Forwarders
Splunk knows where to break the event, where the time stamp is located and how to
automatically create field value pairs using these. - Answer- Source types
