SPLK-1001 Splunk Core Certified User Questions and Answers

Correlated

File-based

Total

Segmented

Table

Report

Pie chart

User

Alerting

Power

Admin

A field that appears in any event

A field that appears in every event

A field that appears in the top 10 events

A field that appears in at least 20% of the events

Chronological

Reverser chronological

ASCIE

Alphabetical

5 minutes

1 minute

10 minutes

60 minutes

Dashboards

Searches

Webhooks

Reports

action

clientip

categoryld

sourcetype

Splunk automatically discovers only numeric fields

Splunk automatically discovers only alphanumeric fields

Splunk automatically discovers only manually configured fields

Splunk automatically discovers only fields directly related to the search results

host

index

source

sourcetype

False

True

In descending order by action, then descending order by file, and lastly by ascending order of bytes.

In ascending order by action, then descending order by file, and lastly by ascending order of bytes.

In descending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

In ascending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

Real-time

10 Minutes

Overnight Download

30 Minutes

False

True

_time and host

_time and index

host and sourcetype

index and sourcetype

Yes

No

True

False

#

%

a

a#

time

_time

EventTime

timestamp

host

owner

bytes

action

Top values by time

Rare values by time

Events with top value fields

Events with rare value fields

Any newly created dashboard will include that report.

There are no benefits to creating dashboard panels from reports.

It makes the dashboard more efficient because it only has to run one search string.

Any change to the underlying report will affect every dashboard that utilizes that report.

Attributes

Constraints

CSV, JSON, PDF

CSV, XML JSON

Raw Events, XML, JSON

Raw Events, CSV, XML, JSON

| rename action = CustomerAction

| rename Action as “Customer Action”

| rename Action to “Customer Action”

| rename action as “Customer Action”

Yes

No

True

False

True

False

True

False

Dashboards

Metadata only

Non-interesting fields

Field descriptions

Indexing

Searching

Parsing

Settings

Input

Yes

No

Line charts are optimal for single and multiple series.

Line charts are optimal for single series when using Fast mode.

Line charts are optimal for multiple series with 3 or more columns.

Line charts are optimal for multiseries searches with at least 2 or more columns.

stdev

dev

count deviation

by standarddev

No

Yes

@

&

*

#

Red

Blue

Orange

Highlighted

index=security Error Fail

index=security error OR fail

index=security “error failure”

index=security NOT error NOT fail

False

True

Saving the item to a report

Adding the item to the search.

Adding the item to a dashboard

Saving the search to a JSON file.

Index Forwarders (IF)

Universal Forwarders (UF)

Super Forwarder (SF)

Heavy Forwarders (HF)

(index=netfw failure) AND index=netops warn OR critical

(index=netfw failure) OR (index=netops (warn OR critical))

(index=netfw failure) AND (index=netops (warn OR critical))

(index=netfw failure) OR index=netops OR (warn OR critical)

10

50

100

20

Parentheses

@ or # symbols

Quotation marks

Relational operators such as =, <, or >

By scheduling a report.

By creating a link to the job.

By changing the job settings.

By changing the time range picker to more than 7 days.

index

action

_time

host

True

False

lookup

csvlookup

inputlookup

outputlookup

Real-time searches happen instantly, while relative searches happen at a scheduled time.

Real-time searches display results from a rolling time window, while relative searches display results from a set length of time.

Real-time searches run constantly in the background, while relative searches only run when certain criteria are met.

Real-time represents events that have happened in a set time window, while relative will display results from a rolling time window.

After saving the report, click Schedule.

After saving the report, click Event Type.

After saving the report, click Scheduling.

After saving the report, click Dashboard Panel.

CTRL + Enter

Shift + Enter

Space + Enter

ALT + Enter

Before clauses. For example: stats sum(bytes) | by host

Before commands. For example: | stats sum(bytes) by host

Before arguments. For example: stats sum| (bytes) by host

Before functions. For example: stats |sum(bytes) by host

Filter as early as possible.

Never specify more than one index.

Include as few search terms as possible.

Use wildcards to return more search results.

error AND (fail AND 400)

error OR (fail and 400)

error AND (fail OR 400)

error OR fail OR 400

users

power users

administrators

| rare top=5

| top rare=5

| top limit=5

| rare limit=5

"failed password"

''failed password"*

index=* "failed password"

index=security "failed password"

False

True

sourcetype=access_* | maximum totals by bytes

sourcetype=access_* | avg (bytes)

sourcetype=access_* | stats max(bytes)

sourcetype=access_* | max(bytes)

Will display result depending on the data.

Will return event where status field exist but value of that field is not 100.

Will return event where status field exist but value of that field is not 100 and all events where status field

doesn't exist.

3

2

4

1

h

day

mon

yr

y

w

week

dedup

rename

sort -

fields +

Designed to cater numerous use cases and empower Splunk.

We can not install Splunk App.

Allows multiple workspaces for different use cases/user roles.

It is collection of different Splunk config files like data inputs, UI and Knowledge Object.

True

False

2, 1, 3

1, 2, 3

2, 3, 1

3, 2, 1

Use field +to add and field -to remove.

Use table +to add and table -to remove.

Use fields +to add and fields –to remove.

Use fields Plus to add and fields Minus to remove.

No events will be returned.

Splunk will prompt you to specify an index.

All non-indexed events to which the user has access will be returned.

Events from every index searched by default to which the user has access will be returned.

New events based on the current time range picker

The same events based on the current time range picker

The same events from when the original search was executed

New events in addition to the same events from the original search

a list of events

transactions

statistical values