SPLK-2001 Online Practice Questions and Answers

How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)

A. No need to do anything, it is turned on by default.

B. When a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1.

C. When a new HEC token is created in Splunk Web, select the checkbox labeled "Enable indexer acknowledgement".

D. When the Global Settings for HEC are updated in Splunk Web, select the checkbox labeled "Enable indexer acknowledgement".

What must be done when calling the serviceNS endpoint?

A. Authenticate with an admin user.

B. Specify the user and app context in the URI.

C. Authenticate with the user of the required context.

D. Pass the user and app context in the request payload.

Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

A. Multiple tokens can be created for use with different sourcetypes and indexes.

B. The edit token http admin role capability is required to create a token.

C. To create a token, send a POST request to services/collector endpoint.

D. Tokens can be edited using the data/inputs/http/{tokenName} endpoint.

Which of the following is an example of a Splunk KV store use case? (Select all that apply.)

A. Stores checkpoint data for modular inputs.

B. Tracks workflow in an incident-review system.

C. Indexes metrics data from remote HTTP sources.

D. Stores application state as a user interacts with an app.

How can hiding or showing a panel by clicking on a chart or a table on the same form be performed?

A. By using vent drilldown.

B. By using workflow action.

C. By using contextual drilldown.

D. By using visualization drilldown.

Which of the following is an example of a valid syntax for specifying an absolute time range modifier in a search?

A. earliest=01/01/2019:00:00:00

B. earliest=01/01/2019T00:00:00

C. earliest=2019-01-01 00:00:00

D. earliest=2019-01-01T00:00:00

Place content to set on page load inside which of the following Simple XML tags?

A.

B.

C.

D.

A user wants to add the token $token_name$ to a dashboard for use in a drilldown. Which token filter encodes URL values?

A. $$token_name$$

B. $token_name|h$

C. $token_name|n$

D. $token_name|u$

Which of the following are security best practices for Splunk app development? (Select all that apply.)

A. Store passwords in clear text in .conf files.

B. Implement security in software development lifecycle.

C. Manually test application with the controls listed in the OWASP Security Testing Guide.

D. Use a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities.

Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

A. stats

B. tstats

C. tscollect

D. transaction