Changed SPLK-1001 Exam Questions

Splunk Core Certified User Exam Questions and Answers

Question 45

Which search will return only events containing the word “error” and display the results as a table that includes

the fields named action, src, and dest?

error | table action, src, dest

error | tabular action, src, dest

error | stats table action, src, dest

error | table column=action column=src column=dest

Question 46

Which command is used to validate a lookup file?

| lookup products.csv

inputlookup products.csv

I inputlookup products.csv

| lookup definition products.csv

Question 47

When displaying results of a search, which of the following is true about line charts?

Line charts are optimal for single and multiple series.

Line charts are optimal for single series when using Fast mode.

Line charts are optimal for multiple series with 3 or more columns.

Line charts are optimal for multiseries searches with at least 2 or more columns.

Question 48

Which time range picker configuration would return real-time events for the past 30 seconds?

Preset - Relative: 30-seconds ago

Relative - Earliest: 30-seconds ago, Latest: Now

Real-time - Earliest: 30-seconds ago, Latest: Now

Advanced - Earliest: 30-seconds ago, Latest: Now