SPLK-1001

How are events displayed after a search is executed?A . In chronological order.B . Randomly by default.C . In reverse chronological order.D . Alphabetically according to field name.View AnswerAnswer: A Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Eventorderfunctions

Which of the following represents the Splunk recommended naming convention for dashboards?A . Description_Group_ObjectB . Group_Description_ObjectC . Group_Object_DescriptionD . Object_Group_DescriptionView AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/ Developnamingconventionsforknowledgeobjecttitles

What is a primary function of a scheduled report?A . Auto-detect changes in performance.B . Auto-generated PDF reports of overall data trends.C . Regularly scheduled archiving to keep disk space use low.D . Triggering an alert in your Splunk instance when certain conditions are met.View AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Report/Schedulereports

When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?A . |B . $C . !D . ,View AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Sort

Which of the following are common constraints of the top command?A . limit, countB . limit, showpercentC . limits, countfieldD . showperc, countfieldView AnswerAnswer: A

What must be done in order to use a lookup table in Splunk?A . The lookup must be configured to run automatically.B . The contents of the lookup file must be copied and pasted into the search bar.C . The lookup file must be uploaded to Splunk and a lookup...

How can search results be kept longer than 7 days?A . By scheduling a report.B . By creating a link to the job.C . By changing the job settings.D . By changing the time range picker to more than 7 days.View AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Extendjoblifetimes

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by priceA . index=security sourcetype=access_* status=200 stats | count by priceB . index=security sourcetype=access_* status=200 | stats count by priceC . index=security sourcetype=access_* status=200 | stats count | by...

Which command is used to review the contents of a specified static lookup file?A . lookupB . csvlookupC . inputlookupD . outputlookupView AnswerAnswer: C

Which of the following Splunk components typically resides on the machines where data originates?A . IndexerB . ForwarderC . Search headD . Deployment serverView AnswerAnswer: C