Splunk Core Certified User (SPLK-1001)

In the fields sidebar, what indicates that a field is numeric?

Which of the following are functions of the stats command?

At index time, in which field does Splunk store the timestamp value?

Which of the following is a best practice when writing a search string?

What type of search can be saved as a report?

What can be included in the All Fields option in the sidebar?

When viewing the results of a search, what is an Interesting Field?

When a Splunk search generates calculated data that appears in the Statistics tab, in what formats can the results be exported?

Which search matches the events containing the terms `error` and `fail`?

Which of the following is an option after clicking an item in search results?

Which of the following fields is stored with the events in the index?

Which of the following is the recommended way to create multiple dashboards displaying data from the same search?

What does the following specified time range do?

earliest=-72h@h latest=@d

Which events will be returned by the following search string? host=www3 status=503

What does the stats command do?

Which is primary function of the timeline located under the search bar?

What can be configured using the Edit Job Settings menu?

Which command is used to validate a lookup file?

Which statement is true about the top command?

How can another user gain access to a saved report?

What is the primary use for the rare command?

What happens when a field is added to the Selected Fields list in the fields sidebar?

By default, which of the following is a Selected Field?

According to Splunk best practices, which placement of the wildcard results in the most efficient search?

Which command automatically returns percent and count columns when executing searches?

Which of the following describes lookup files?

Which search string is the most efficient?

Which search string matches only events with the status_code of 404?

_____________ transforms raw data into events and distributes the results into an index.

Documentations for Splunk can be found at docs.splunk.com

Which component of Splunk is primarily responsible for saving data?

Universal forwarder is recommended for forwarding the logs to indexers.

Splunk apps are used for following (Choose three.):

Three basic components of Splunk are (Choose three.):

What is Splunk?

We should use heavy forwarder for sending event-based data to Indexers.

Splunk Enterprise is used as a Scalable service in Splunk Cloud.

Which component of Splunk let us write SPL query to find the required data?

All components are installed and administered in Splunk Enterprise on-premise.

Log filtering/parsing can be done from _____________.

Which is the default app for Splunk Enterprise?

What kind of logs can Splunk Index?

Portal for Splunk apps can be accessed through www.splunkbase.com