Splunk Core Certified User SPLK-1001 Exam Questions and Answers PDF

Splunk Core Certified User Exam Questions and Answers

Question 41

Which stats command function provides a count of how many unique values exist for a given field in the result set?

dc(field)

count(field)

count-by(field)

distinct-count(field)

Question 42

Which search will return the 15 least common field values for the dest_ip field?

sourcetype=firewall | rare num=15 dest_ip

sourcetype=firewall | rare last=15 dest_ip

sourcetype=firewall | rare count=15 dest_ip

sourcetype=firewall | rare limit=15 dest_ip

Question 43

Which is a primary function of the timeline located under the search bar?

To differentiate between structured and unstructured events in the data

To sort the events returned by the search command in chronological order

To zoom in and zoom out. although this does not change the scale of the chart

To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime

Question 44

Which search string only returns events from hostWWW3?

B. host=WWW3

C. host=WWW*

D. Host=WWW3