Splunk Core Certified User Test! Trivia Questions Quiz

111 Questions | By Buddeny | Last updated: Mar 22, 2022 | Total Attempts: 1853

Questions

Settings

Create your own Quiz

Splunk Core Certified User Test! Trivia Questions Quiz - Quiz

Questions and Answers

1.

Which command is used to review the contents of a specified static lookup file?
- A.
  
  Lookup
- B.
  
  Csvlookup
- C.
  
  Inputlookup
- D.
  
  Outputlookup
2.

Which time range picker configuration would return real-time events for the past 30 seconds?
- A.
  
  Preset - Relative: 30-seconds ago
- B.
  
  Relative - Earliest: 30-seconds ago, Latest: Now
- C.
  
  Real-time - Earliest: 30-seconds ago, Latest: Now
- D.
  
  Advanced - Earliest: 30-seconds ago, Latest: Now
3.

What is one benefit of creating dashboard panels from reports?
- A.
  
  Any newly created dashboard will include that report.
- B.
  
  B. There are no benefits to creating dashboard panels from reports.
- C.
  
  C. It makes the dashboard more efficient because it only has to run one search string.
- D.
  
  D. Any change to the underlying report will affect every dashboard that utilizes that report.
4.

Which of the following statements about case sensitivity is true?
- A.
  
  Both field names and field values ARE case sensitive.
- B.
  
  Field names ARE case sensitive; field values are NOT.
- C.
  
  Field values ARE case sensitive; field names ARE NOT.
- D.
  
  Both field names and field values ARE NOT case sensitive.
5.

What does the rare command do?
- A.
  
  Returns the least common field values of a given field in the results.
- B.
  
  Returns the most common field values of a given field in the results.
- C.
  
  Returns the top 10 field values of a given field in the results.
- D.
  
  Returns the lowest 10 field values of a given field in the results.
6.

Which Boolean operator is always implied between two search terms, unless otherwise specified?
- A.
  
  Or
- B.
  
  Not
- C.
  
  And
- D.
  
  Xor
7.

What does the values function of the stats command do?
- A.
  
  Lists all values of a given field.
- B.
  
  Lists unique values of a given field.
- C.
  
  Returns a count of unique values for a given field.
- D.
  
  Returns the number of events that match the search.
8.

A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?
- A.
  
  Click All Fields and select the field to add it to Selected Fields.
- B.
  
  Click Interesting Fields and select the field to add it to Selected Fields.
- C.
  
  Click Selected Fields and select the field to add it to Interesting Fields. This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.
- D.
  
  This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.
9.

In the fields sidebar, which character denotes alphanumeric field values?
- A.
  
  #
- B.
  
  %
- C.
  
  A
- D.
  
  A#
10.

Which of the following is the most efficient filter for running searches in Splunk?
- A.
  
  Time
- B.
  
  Fast mode
- C.
  
  Sourcetype
- D.
  
  Selected fields
11.

What is the correct syntax to count the number of events containing a vendor_action field?=
- A.
  
  Count stats vendor_action
- B.
  
  Count stats (vendor_action)
- C.
  
  Stats count (vendor_action)
- D.
  
  Stats vendor_action (count)
12.

By default, which of the following fields would be listed in the fields sidebar under interesting Fields?
- A.
  
  Host
- B.
  
  Index
- C.
  
  Source
- D.
  
  Sourcetype
13.

When looking at a dashboard panel that is based on a report, which of the following is true?
- A.
  
  You can modify the search string in the panel, and you can change and configure the visualization.
- B.
  
  You can modify the search string in the panel, but you cannot change and configure the visualization.
- C.
  
  You cannot modify the search string in the panel, but you can change and configure the visualization.
- D.
  
  You cannot modify the search string in the panel, and you cannot change and configure the visualization.
14.

When looking at a dashboard panel that is based on a report, which of the following is true?
- A.
  
  You can modify the search string in the panel, and you can change and configure the visualization.
- B.
  
  You can modify the search string in the panel, but you cannot change and configure the visualization.
- C.
  
  You cannot modify the search string in the panel, but you can change and configure the visualization.
- D.
  
  You cannot modify the search string in the panel, and you cannot change and configure the visualization.
15.

Which of the following is a best practice when writing a search string?
- A.
  
  Include all formatting commands before any search terms
- B.
  
  Include at least one function as this is a search requirement
- C.
  
  Include the search terms at the beginning of the search string
- D.
  
  Avoid using formatting clauses as they add too much overhead
16.

What type of search can be saved as a report?
- A.
  
  Any search can be saved as a report
- B.
  
  Only searches that generate visualizations
- C.
  
  Only searches containing a transforming command
- D.
  
  Only searches that generate statistics or visualizations
17.

What can be included in the All Fields option in the sidebar?
- A.
  
  Dashboards
- B.
  
  Metadata only
- C.
  
  Non-interesting fields
- D.
  
  Field descriptions
18.
1. What syntax is used to link key/value pairs in search strings?
- A.
  
  Action+purchase
- B.
  
  Action=purchase
- C.
  
  Action | purchase
- D.
  
  Action equal purchase
19.

When viewing the results of a search, what is an Interesting Field?
- A.
  
  A field that appears in any event
- B.
  
  A field that appears in every event
- C.
  
  A field that appears in the top 10 events
- D.
  
  A field that appears in at least 20% of the events
20.

What syntax is used to link key/value pairs in search strings?
- A.
  
  Parentheses
- B.
  
  @ or # symbols
- C.
  
  Quotation marks
- D.
  
  Relational operators such as =, <, or >
21.

When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?
- A.
  
  CSV, JSON, PDF
- B.
  
  CSV, XML JSON
- C.
  
  Raw Events, XML, JSON
- D.
  
  Raw Events, CSV, XML, JSON
22.

Which of the following are functions of the stats command?
- A.
  
  Count, sum, add
- B.
  
  Count, sum, less
- C.
  
  Sum, avg, values
- D.
  
  Sum, values, table
23.

In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?
- A.
  
  No events will be returned.
- B.
  
  Splunk will prompt you to specify an index.
- C.
  
  All non-indexed events to which the user has access will be returned.
- D.
  
  Events from every index searched by default to which the user has access will be returned.
24.

Which search matches the events containing the terms "error" and "fail"?
- A.
  
  Index=security Error Fail
- B.
  
  Index=security error OR fail
- C.
  
  Index=security "error failure"
- D.
  
  Index=security NOT error NOT fail
25.

Which of the following is an option after clicking an item in search results?
- A.
  
  Saving the item to a report
- B.
  
  Adding the item to the search.
- C.
  
  Adding the item to a dashboard
- D.
  
  Saving the search to a JSON file.