Question 1

Which of the following searches will return results where fail, 400, and error exist in every event?

Accepted Answer

A)   error AND (fail AND 400) 
B)   error OR (fail and 400) 
C)   error AND (fail OR 400) 
D)   error OR fail OR 400E) None of the above
F) A) and B)

Question 2

Which of the following Splunk components typically resides on the machines where data originates?

Accepted Answer

A)   Indexer
B)   Forwarder
C)   Search head
D)   Deployment serverE) A) and B)
F) A) and C)

Question 3

Data sources being opened and read applies to:

Accepted Answer

A)   None of the above
B)   Indexing Phase
C)   Parsing Phase
D)   Input Phase
E)   License MeteringF) All of the above
G) D) and E)

Question 4

Parsing of data can happen both in HF and Indexer.

Accepted Answer

A)   Only HF
B)   No
C)   YesD) None of the above
E) All of the above

Question 5

When looking at a dashboard panel that is based on a report, which of the following is true?

Accepted Answer

A)   You can modify the search string in the panel, and you can change and configure the visualization.
B)   You can modify the search string in the panel, but you cannot change and configure the visualization.
C)   You cannot modify the search string in the panel, but you can change and configure the visualization.
D)   You cannot modify the search string in the panel, and you cannot change and configure the visualization.E) A) and D)
F) A) and C)

Question 6

Which of the statements is correct regarding click and drag option in timeline?

Accepted Answer

A)   The new result after selecting the range by dragging filters the events and displays the most recent first.
B)   There is no functionality like click and drag in Splunk's timeline.
C)   Using this option executes a new query.
D)   This doesn't execute a new query.E) A) and B)
F) B) and C)

Question 7

The new data uploaded in Splunk are shown in ________________.

Accepted Answer

A)   Real-time
B)   10 Minutes
C)   Overnight Download
D)   30 MinutesE) A) and D)
F) A) and C)

Question 8

Splunk automatically determines the source type for major data types.

Accepted Answer

A) True 
 B)False

Question 9

Which of the following statements are correct about Search & Reporting App? (Choose three.)

Accepted Answer

A)   Can be accessed by Apps > Search & Reporting.
B)   Provides default interface for searching and analyzing logs.
C)   Enables the user to create knowledge object, reports, alerts and dashboards.
D)   It only gives us search functionality.E) B) and D)
F) All of the above

Question 10

Monitor option in Add Data provides _______________.

Accepted Answer

A)   Only continuous monitoring.
B)   Only One-time monitoring.
C)   None of the above.
D)   Both One-time and continuous monitoring.E) C) and D)
F) All of the above

Question 11

At index time, in which field does Splunk store the timestamp value?

Accepted Answer

A)   time
B)   _time
C)   EventTime
D)   timestampE) B) and D)
F) A) and B)

Question 12

What determines the scope of data that appears in a scheduled report?

Accepted Answer

A)   All data accessible to the User role will appear in the report.
B)   All data accessible to the owner of the report will appear in the report.
C)   All data accessible to all users will appear in the report until the next time the report is run.
D)   The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.E) All of the above
F) B) and C)

Question 13

NOT status = 100:

Accepted Answer

A)   Will display result depending on the data.
B)   Will return event where status field exist but value of that field is not 100.
C)   Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.D) B) and C)
E) None of the above

Question 14

What happens when a field is added to the Selected Fields list in the fields sidebar?

Accepted Answer

A)   Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field.
B)   Splunk will highlight related fields as a suggestion to add them to the Selected Fields list.
C)   Custom selections will replace the Interesting Fields that Splunk populated into the list at search time.
D)   The selected field and its corresponding values will appear underneath the events in the search results.E) B) and D)
F) All of the above

Question 15

Which of the following statements about case sensitivity is true?

Accepted Answer

A)   Both field names and field values ARE case sensitive.
B)   Field names ARE case sensitive; field values are NOT.
C)   Field values ARE case sensitive; field names ARE NOT.
D)   Both field names and field values ARE NOT case sensitive.E) B) and D)
F) None of the above

Question 16

Which is primary function of the timeline located under the search bar?

Accepted Answer

A)   To differentiate between structured and unstructured events in the data.
B)   To sort the events returned by the search command in chronological order.
C)   To zoom in and zoom out, although this does not change the scale of the chart.
D)   To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime.E) A) and B)
F) B) and C)

Question 17

What options do you get after selecting timeline? (Choose four.)

Accepted Answer

A)   Zoom to selection
B)   Format Timeline
C)   Deselect
D)   Delete
E)   Zoom OutF) C) and D)
G) A) and E)

Question 18

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Accepted Answer

A)   Cloned panel
B)   Inline panel
C)   Report panel
D)   Prebuilt panelE) C) and D)
F) A) and D)

Question 19

Which of the following fields is stored with the events in the index?

Accepted Answer

A)   user
B)   source
C)   location
D)   sourceIpE) A) and B)
F) A) and C)

Question 20

@ Symbol can be used in advanced time unit option.

Accepted Answer

A)   No
B)   YesC) A) and B)
D) undefined

Exam 1: Splunk Core Certified User

@ Symbol can be used in advanced time unit option.

Correct AnswerverifiedShow Answer

The new data uploaded in Splunk are shown in ________________.

Correct AnswerverifiedShow Answer

Data sources being opened and read applies to:

Correct AnswerverifiedShow Answer

Which of the statements is correct regarding click and drag option in timeline?

Correct AnswerverifiedShow Answer

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Correct AnswerverifiedShow Answer

Which of the following statements are correct about Search & Reporting App? (Choose three.)

Correct AnswerverifiedShow Answer

Parsing of data can happen both in HF and Indexer.

Correct AnswerverifiedShow Answer

Which is primary function of the timeline located under the search bar?

Correct AnswerverifiedShow Answer

What options do you get after selecting timeline? (Choose four.)

Correct AnswerverifiedShow Answer

NOT status = 100:

Correct AnswerverifiedShow Answer

Which of the following statements about case sensitivity is true?

Correct AnswerverifiedShow Answer

Which of the following fields is stored with the events in the index?

Correct AnswerverifiedShow Answer

Splunk automatically determines the source type for major data types.

Correct AnswerverifiedShow Answer

At index time, in which field does Splunk store the timestamp value?

Correct AnswerverifiedShow Answer

What happens when a field is added to the Selected Fields list in the fields sidebar?

Correct AnswerverifiedShow Answer

When looking at a dashboard panel that is based on a report, which of the following is true?

Correct AnswerverifiedShow Answer

Which of the following searches will return results where fail, 400, and error exist in every event?

Correct AnswerverifiedShow Answer

What determines the scope of data that appears in a scheduled report?

Correct AnswerverifiedShow Answer

Monitor option in Add Data provides _______________.

Correct AnswerverifiedShow Answer

Which of the following Splunk components typically resides on the machines where data originates?

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified