Splunk SPLK-1001 問題練習

Question No : 1
What does the following specified time range do?
[email protected] [email protected]

• A.Look back 3 days ago and prior
• B.Look back 72 hours up to one day ago
• C.Look back 72 hours, up to the end of today
• D.Look back from 3 days ago up to the beginning of today

答えを確認する

正解:

Question No : 2
Select the correct option that applies to Index time processing (Choose three.).

• A.Indexing
• B.Searching
• C.Parsing
• D.Settings
• E.Input

答えを確認する

正解:

Question No : 3
How do you add or remove fields from search results?

• A.Use field +to add and field -to remove.
• B.Use table +to add and table -to remove.
• C.Use fields +to add and fields Cto remove.
• D.Use fields Plus to add and fields Minus to remove.

答えを確認する

正解:

Question No : 4
What happens when a field is added to the Selected Fields list in the fields sidebar'?

• A.Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field
• B.Splunk will highlight related fields as a suggestion to add them to the Selected Fields list.
• C.Custom selections will replace the Interesting Fields that Splunk populated into the list at search time
• D.The selected field and its corresponding values will appear underneath the events in the search results

答えを確認する

正解:

Question No : 5
Which component of Splunk let us write SPL query to find the required data?

• A.Forwarders
• B.Indexer
• C.Heavy Forwarders
• D.Search head

答えを確認する

正解:

Question No : 6
It is mandatory for the lookup file to have this for an automatic lookup to work.

• A.Source type
• B.At least five columns
• C.Timestamp
• D.Input filed

答えを確認する

正解:

Question No : 7
What does the stats command do?

• A.Automatically correlates related fields
• B.Converts field values into numerical values
• C.Calculates statistics on data that matches the search criteria
• D.Analyzes numerical fields for their ability to predict another discrete field

答えを確認する

正解:

Question No : 8
Prefix wildcards might cause performance issues.

• A.False
• B.True

答えを確認する

正解:

Question No : 9
When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

• A.|
• B.$
• C.!
• D.,

答えを確認する

正解:

Question No : 10
Three basic components of Splunk are (Choose three.):

• A.Forwarders
• B.Deployment Server
• C.Indexer
• D.Knowledge Objects
• E.Index
• F.Search Head

答えを確認する

正解:

Question No : 11
Forward Option gather and forward data to indexers over a receiving port from remote machines.

• A.False
• B.True

答えを確認する

正解:

Question No : 12
Fields are searchable key value pairs in your event data.

• A.True
• B.False

答えを確認する

正解:

Question No : 13
Which of the following is the most efficient search?

• A.index=* “failed password”
• B.“failed password” index=*
• C.(index=* OR index=security) “failed password”
• D.index=security “failed password”

答えを確認する

正解:

Question No : 14
When an alert action is configured to run a script, Splunk must be able to locate the script.
Which is one of the directories Splunk will look in to find the script?

• A.$SPLUNK_HOME/bin/scripts
• B.$SPLUNK_HOME/etc/scripts
• C.$SPLUNK_HOME/bin/etc/scripts
• D.$SPLUNK_HOME/etc/scripts/bin

答えを確認する

正解:

Question No : 15
What determines the scope of data that appears in a scheduled report?

• A.All data accessible to the User role will appear in the report.
• B.All data accessible to the owner of the report will appear in the report.
• C.All data accessible to all users will appear in the report until the next time the report is run.
• D.The owner of the report can configure permissions so that the report uses either the User role or the owner’s profile at run time.

答えを確認する

正解: