SPLK-1001 Online Practice Questions and Answers

This is what Splunk uses to categorize the data that is being indexed.

A. Host

B. Sourcetype

C. Index

D. Source

Which of the following is the best description of Splunk Apps?

A. Built only by Splunk employees.

B. A collection of files.

C. Only available for download on Splunkbase.

D. Available on iOS and Android.

Which of the following index searches would provide the most efficient search performance?

A. index=*

B. index=web OR index=s*

C. (index=web OR index=sales)

D. *index=sales AND index=web*

When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?

A. CSV, JSON, PDF

B. CSV, XML JSON

C. Raw Events, XML, JSON

D. Raw Events, CSV, XML, JSON

Which of the following commands will show the maximum bytes?

A. sourcetype=access_* | maximum totals by bytes

B. sourcetype=access_* | avg (bytes)

C. sourcetype=access_* | stats max(bytes)

D. sourcetype=access_* | max(bytes)

In the fields sidebar, what indicates that a field is numeric?

A. A number to the right of the field name.

B. A # symbol to the left of the field name.

C. A lowercase n to the left of the field name.

D. A lowercase n to the right of the field name.

Machine data can be in structured and unstructured format.

A. False

B. True

What is the proper SPL terminology for specifying a particular index in a search?

A. indexer--index_name

B. indexer name--index_name

C. index=index_name

D. index name=index_name

Log filtering/parsing can be done from _____________.

A. Index Forwarders (IF)

B. Universal Forwarders (UF)

C. Super Forwarder (SF)

D. Heavy Forwarders (HF)

Which search string matches only events with the status_code of 4:4?

A. status_code !=404

B. status_code>=400

C. status_code<=404

D. status code>403 status_code<405