SPLK-1001 Splunk Exam Lab Questions

Splunk Core Certified User Exam Questions and Answers

Question 13

You can use the following options to specify start and end time for the query range:

earliest=

latest=

beginning=

ending=

All the above

Only 3rd and 4th

Question 14

Which search string returns a filed containing the number of matching events and names that field Event Count?

index=security failure | stats sum as “Event Count”

index=security failure | stats count as “Event Count”

index=security failure | stats count by “Event Count”

index=security failure | stats dc(count) as “Event Count”

Question 15

You can on-board data to Splunk using following means (Choose four.):

Props

CLI

Splunk Web

savedsearches.conf

Splunk apps and add-ons

indexes.conf

inputs.conf

Question 16

Log filtering/parsing can be done from _____________.

Index Forwarders (IF)

Universal Forwarders (UF)

Super Forwarder (SF)

Heavy Forwarders (HF)