Question 1

Which of the statements are correct? (Choose three.)

Accepted Answer

A)  Zoom to selection: Narrows the time range and re-executes the search. 
B)  Zoom to selection: Narrows the time range and doesn't re-executes the search. 
C)  Format Timeline: Hides or shows the timeline in different views. 
D)  Zoom-Out: Expands the time focus and doesn't re-executes the search. 
E)  Zoom-out: Expands the time focus and re-executes the search. 
A)  Zoom to selection: Narrows the time range and re-executes the search. 
B)  Zoom to selection: Narrows the time range and doesn't re-executes the search. 
C)  Format Timeline: Hides or shows the timeline in different views. 
D)  Zoom-Out: Expands the time focus and doesn't re-executes the search. 
E)  Zoom-out: Expands the time focus and re-executes the search.

Question 2

What is the main requirement for creating visualizations using the Splunk UI?

Accepted Answer

A)  Your search must transform event data into Excel file format first. 
B)  Your search must transform event data into XML formatted data first. 
C)  Your search must transform event data into statistical data tables first. 
D)  Your search must transform event data into JSON formatted data first. 
A)  Your search must transform event data into Excel file format first. 
B)  Your search must transform event data into XML formatted data first. 
C)  Your search must transform event data into statistical data tables first. 
D)  Your search must transform event data into JSON formatted data first.

Question 3

Splunk Parses data into individual events, extracts time, and assigns metadata.

Accepted Answer

A) True 
 B)False

Question 4

Which of the following can be used as wildcard search in Splunk?

Accepted Answer

A)  = 
B)  > 
C)  ! 
D)  * 
A)  = 
B)  > 
C)  ! 
D)  *

Question 5

When looking at a statistics table, what is one way to drill down to see the underlying events?

Accepted Answer

A)  Creating a pivot table. 
B)  Clicking on the visualizations tab. 
C)  Viewing your report in a dashboard. 
D)  Clicking on any field value in the table. 
A)  Creating a pivot table. 
B)  Clicking on the visualizations tab. 
C)  Viewing your report in a dashboard. 
D)  Clicking on any field value in the table.

Question 6

When displaying results of a search, which of the following is true about line charts?

Accepted Answer

A)  Line charts are optimal for single and multiple series. 
B)  Line charts are optimal for single series when using Fast mode. 
C)  Line charts are optimal for multiple series with 3 or more columns. 
D)  Line charts are optimal for multiseries searches with at least 2 or more columns. 
A)  Line charts are optimal for single and multiple series. 
B)  Line charts are optimal for single series when using Fast mode. 
C)  Line charts are optimal for multiple series with 3 or more columns. 
D)  Line charts are optimal for multiseries searches with at least 2 or more columns.

Question 7

Field values are case sensitive.

Accepted Answer

A) True 
 B)False

Question 8

In monitor option you can select the following options in GUI.

Accepted Answer

A)  Only HTTP Event Collector (HE
C)  and TCP/UDP 
B)  None of the above 
C)  Only TCP/UDP 
D)  Only Scripts 
E)  Filed & Directories, HTTP Event Collector (HE
C) , TCP/UDP and Scripts 
A)  Only HTTP Event Collector (HE
C)  and TCP/UDP 
B)  None of the above 
C)  Only TCP/UDP 
D)  Only Scripts 
E)  Filed & Directories, HTTP Event Collector (HE
C) , TCP/UDP and Scripts

Question 9

How many main user roles do you have in Splunk?

Accepted Answer

A)  2 
B)  4 
C)  1 
D)  3 
A)  2 
B)  4 
C)  1 
D)  3

Question 10

Which stats command function provides a count of how many unique values exist for a given field in the result set?

Accepted Answer

A)  dc(field) 
B)  count(field) 
C)  count-by(field) 
D)  distinct-count(field) 
A)  dc(field) 
B)  count(field) 
C)  count-by(field) 
D)  distinct-count(field)

Question 11

______________ is the default web port used by Splunk.

Accepted Answer

A)  8089 
B)  8000 
C)  8080 
D)  443 
A)  8089 
B)  8000 
C)  8080 
D)  443

Question 12

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price

Accepted Answer

A)  index=security sourcetype=access_* status=200 stats | count by price 
B)  index=security sourcetype=access_* status=200 | stats count by price 
C)  index=security sourcetype=access_* status=200 | stats count | by price 
D)  index=security sourcetype=access_* | status=200 | stats count by price 
A)  index=security sourcetype=access_* status=200 stats | count by price 
B)  index=security sourcetype=access_* status=200 | stats count by price 
C)  index=security sourcetype=access_* status=200 | stats count | by price 
D)  index=security sourcetype=access_* | status=200 | stats count by price

Question 13

Which of the following searches would return events with failure in index netfw or warn or critical netops ?

Accepted Answer

A)  (index=netfw failure) AND index=netops warn OR critical 
B)  (index=netfw failure) OR (index=netops (warn OR critical)) 
C)  (index=netfw failure) AND (index=netops (warn OR critical)) 
D)  (index=netfw failure) OR index=netops OR (warn OR critical) 
A)  (index=netfw failure) AND index=netops warn OR critical 
B)  (index=netfw failure) OR (index=netops (warn OR critical)) 
C)  (index=netfw failure) AND (index=netops (warn OR critical)) 
D)  (index=netfw failure) OR index=netops OR (warn OR critical)

Question 14

When editing a dashboard, which of the following are possible options? (Choose all that apply.)

Accepted Answer

A)  Add an output. 
B)  Export a dashboard panel. 
C)  Modify the chart type displayed in a dashboard panel. 
D)  Drag a dashboard panel to a different location on the dashboard. 
A)  Add an output. 
B)  Export a dashboard panel. 
C)  Modify the chart type displayed in a dashboard panel. 
D)  Drag a dashboard panel to a different location on the dashboard.

Question 15

Upload option creates inputs.conf

Accepted Answer

A)  Yes 
B)  No 
A)  Yes 
B)  No

Question 16

Splunk extracts fields from event data at index time and at search time.

Accepted Answer

A) True 
 B)False

Question 17

What syntax is used to link key/value pairs in search strings?

Accepted Answer

A)  action+purchase 
B)  action=purchase 
C)  action | purchase 
D)  action equal purchase 
A)  action+purchase 
B)  action=purchase 
C)  action | purchase 
D)  action equal purchase

Question 18

By default, which of the following is a Selected Field?

Accepted Answer

A)  action 
B)  clientip 
C)  categoryId 
D)  sourcetype 
A)  action 
B)  clientip 
C)  categoryId 
D)  sourcetype

Question 19

Zoom Out and Zoom to Selection re-executes the search.

Accepted Answer

A)  No 
B)  Yes 
A)  No 
B)  Yes

Question 20

Field names are case sensitive.

Accepted Answer

A) True 
 B)False

Which of the statements are correct? (Choose three.)

What is the main requirement for creating visualizations using the Splunk UI?

Splunk Parses data into individual events, extracts time, and assigns metadata.

Which of the following can be used as wildcard search in Splunk?

When looking at a statistics table, what is one way to drill down to see the underlying events?

When displaying results of a search, which of the following is true about line charts?

Field values are case sensitive.

In monitor option you can select the following options in GUI.

How many main user roles do you have in Splunk?

Which stats command function provides a count of how many unique values exist for a given field in the result set?

______________ is the default web port used by Splunk.

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price

Which of the following searches would return events with failure in index netfw or warn or critical netops ?

When editing a dashboard, which of the following are possible options? (Choose all that apply.)

Upload option creates inputs.conf

Splunk extracts fields from event data at index time and at search time.

What syntax is used to link key/value pairs in search strings?

By default, which of the following is a Selected Field?

Zoom Out and Zoom to Selection re-executes the search.

Field names are case sensitive.

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Certified Architect

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters

Exam 1: Splunk Core Certified User

Which of the statements are correct? (Choose three.)

What is the main requirement for creating visualizations using the Splunk UI?

Splunk Parses data into individual events, extracts time, and assigns metadata.

Which of the following can be used as wildcard search in Splunk?

When looking at a statistics table, what is one way to drill down to see the underlying events?

When displaying results of a search, which of the following is true about line charts?

Field values are case sensitive.

In monitor option you can select the following options in GUI.

How many main user roles do you have in Splunk?

Which stats command function provides a count of how many unique values exist for a given field in the result set?

______________ is the default web port used by Splunk.

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price

Which of the following searches would return events with failure in index netfw or warn or critical netops ?

When editing a dashboard, which of the following are possible options? (Choose all that apply.)

Upload option creates inputs.conf

Splunk extracts fields from event data at index time and at search time.

What syntax is used to link key/value pairs in search strings?

By default, which of the following is a Selected Field?

Zoom Out and Zoom to Selection re-executes the search.

Field names are case sensitive.

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Certified Architect

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters