Splunk Tests Bundle Set

command for restarting just the splunk webserver CORRECT ANSWER splunk start splunkweb command for restarting just the splunk daemon CORRECT ANSWER splunk start splunkd command to check for running splunk processes on *nix CORRECT ANSWER ps aux | grep splunk run this as root to update your ...

Within , which stanzas are valid for data modification? (select all that apply) A. Host B. Server C. Source D. Sourcetype CORRECT ANSWER ANSWER: ACD The universal forwarder has which capabilities when sending data? A. Sending alerts B. Compressing Data C. Obfuscating/hiding data D. I...

Which installer will you use to install the Search Head? a) Splunk Enterprise b) Splunk Universal Forwarder CORRECT ANSWER a) Splunk Enterprise When you install Splunk on a Windows OS, you also have to configure the boot-start. True or False CORRECT ANSWER False. You only need to do that o...

Splunk Data Admin questions with correct answers

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used? A. The regex can no longer be edited. B. The field being extracted will be required for all future events. C. The events without the required field will n...

which parent directory contains the configuration files in Splunk? CORRECT ANSWER $SPLUNK_HOME/etc where can scripts for scripted inputs reside on the host file system? CORRECT ANSWER $SPLUNK_HOME/bin/scripts $SPLUNK_HOME/etc/system/bin In which Splunk configuration is the SEDCMD used CORRECT...

A calculated field maybe based on which of the following? A. Lookup tables B. Extracted fields C. Regular expressions D. Fields generated within a search string CORRECT ANSWER B. Extracted fields Which are valid ways to create an event type? (select all that apply) A. By using the searchtype...

Admin, Power, User CORRECT ANSWER Out of the box there are 3 main roles Click Data Summary in the Searching & Reporting app CORRECT ANSWER How can you view all sourcetypes? Host, Sources, and Sourcetypes on separate tabs CORRECT ANSWER What is shown in the Data Summary? The local timezone s...

What is the only writeable bucket type? hot bucket warm bucket cold bucket CORRECT ANSWER The hot bucket By what filter are indexes divided into buckets? by time by name by source by host CORRECT ANSWER By time What are the 4 types of searches in Splunk (by performance) dense sparse ...

Which search string only returns events from hostWWW3? A. host=* B. host=WWW3 C. host=WWW* D. Host=WWW3 CORRECT ANSWER B. host=WWW3 Asking for events ONLY By default, how long does Splunk retain a search job? A. 10 Minutes B. 15 Minutes C. 1 Day D. 7 Days CORRECT ANSWER A. 10 minut...

Splunk core certified user exam questions with correct answers

1.1 Performing Statistical analysis with stats function What does the stdev command do? Used only with stats CORRECT ANSWER standard deviation (measure of the extent of deviation of the values) 1.1 Performing Statistical analysis with stats function What does the var command do? Used only w...

What must be done before an automatic lookup can be created? (Choose all that apply.) A. The lookup command must be used. B. The lookup definition must be created. C. The lookup file must be uploaded to Splunk. D. The lookup file must be verified using the inputlookup command. CORRECT ANSWER B ...

Which Field/Value pair will return only events found in the index named security? A: Index=Security B: index=Security C: Index=security D: index!=Security CORRECT ANSWER index=Security Which statement describes field discovery at search time? A: Splunk automatically discovers only numeri...

Which of the following Splunk components typically resides on the machines where data originates? A. Indexer B. Forwarder C. Search head D. Deployment server CORRECT ANSWER B. Forwarder Which of the following searches would return events with failure in index netfw or warn or critical in in...

Core User - Set 4 (SPLK-1001) questions with correct answers

1. How can another user gain access to saved report? CORRECT ANSWER The owner of the report can edit permissions from the Edit dropdown. 1. What happens when a field is added to selected fields list in the field sidebar? CORRECT ANSWER The selected field and its corresponding value will appear un...

How can another user gain access to a saved report? CORRECT ANSWER Anyone can access any reports marked as public within a shared splunk deployment What happens when a field is added to selected fields list is the field sidebar? CORRECT ANSWER The selected field and it's corresponding value will...

Splunk Core User Practice Exam questions with correct answers

Splunk Core User Certification questions with correct answers

MODULE 1: WHAT IS MACHINE DATA - Machine data makes up for more than ___% of the data accumulated by organizations. CORRECT ANSWER 90% MODULE 1: WHAT IS MACHINE DATA - Machine data is always structured. CORRECT ANSWER False MODULE 1: WHAT IS MACHINE DATA - Machine data is only generated by web...

Which one of the following statements about the search command is true? CORRECT ANSWER It behaves exactly like search strings before the first pipe. Which of the following actions can the eval command perform? CORRECT ANSWER Create or replace an existing field. When can a pipe follow a macro? ...

Which one of the following statements about the search command is true? A. It does not allow the use of wildcards. B. It treats field values in a case-sensitive manner. C. It can only be used at the beginning of the search pipeline. D. It behaves exactly like search strings before the first pi...

Selected fields are displayed ________ each event in the results. a. below b. interesting fields c. other fields d. above CORRECT ANSWER a. below Search terms are not case sensitive. (T/F) CORRECT ANSWER True These two searches will NOT return the same results. SEARCH 1:login failure S...

Splunk SPLK-1002 questions with correct answers

SPLUNK SPLK – 1002 questions with correct answers

Calculated fields can be based on which of the following? A. Tags B. Extracted fields C. Output fields for a lookup D. Fields generated from a search string CORRECT ANSWER Extracted fields Which of the following eval command functions is valid? A. int( ) B. count( ) C. print( ) D. tos...