Question 1

What happens when a field is added to the Selected Fields list in the fields sidebar?

Accepted Answer

A)  Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field. 
B)  Splunk will highlight related fields as a suggestion to add them to the Selected Fields list. 
C)  Custom selections will replace the Interesting Fields that Splunk populated into the list at search time. 
D)  The selected field and its corresponding values will appear underneath the events in the search results. 
A)  Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field. 
B)  Splunk will highlight related fields as a suggestion to add them to the Selected Fields list. 
C)  Custom selections will replace the Interesting Fields that Splunk populated into the list at search time. 
D)  The selected field and its corresponding values will appear underneath the events in the search results.

Question 2

Data sources being opened and read applies to:

Accepted Answer

A)  None of the above 
B)  Indexing Phase 
C)  Parsing Phase 
D)  Input Phase 
E)  License Metering 
A)  None of the above 
B)  Indexing Phase 
C)  Parsing Phase 
D)  Input Phase 
E)  License Metering

Question 3

Which of the following Splunk components typically resides on the machines where data originates?

Accepted Answer

A)  Indexer 
B)  Forwarder 
C)  Search head 
D)  Deployment server 
A)  Indexer 
B)  Forwarder 
C)  Search head 
D)  Deployment server

Question 4

When looking at a dashboard panel that is based on a report, which of the following is true?

Accepted Answer

A)  You can modify the search string in the panel, and you can change and configure the visualization. 
B)  You can modify the search string in the panel, but you cannot change and configure the visualization. 
C)  You cannot modify the search string in the panel, but you can change and configure the visualization. 
D)  You cannot modify the search string in the panel, and you cannot change and configure the visualization. 
A)  You can modify the search string in the panel, and you can change and configure the visualization. 
B)  You can modify the search string in the panel, but you cannot change and configure the visualization. 
C)  You cannot modify the search string in the panel, but you can change and configure the visualization. 
D)  You cannot modify the search string in the panel, and you cannot change and configure the visualization.

Question 5

What determines the scope of data that appears in a scheduled report?

Accepted Answer

A)  All data accessible to the User role will appear in the report. 
B)  All data accessible to the owner of the report will appear in the report. 
C)  All data accessible to all users will appear in the report until the next time the report is run. 
D)  The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time. 
A)  All data accessible to the User role will appear in the report. 
B)  All data accessible to the owner of the report will appear in the report. 
C)  All data accessible to all users will appear in the report until the next time the report is run. 
D)  The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.

Question 6

The new data uploaded in Splunk are shown in ________________.

Accepted Answer

A)  Real-time 
B)  10 Minutes 
C)  Overnight Download 
D)  30 Minutes 
A)  Real-time 
B)  10 Minutes 
C)  Overnight Download 
D)  30 Minutes

Question 7

Monitor option in Add Data provides _______________.

Accepted Answer

A)  Only continuous monitoring. 
B)  Only One-time monitoring. 
C)  None of the above. 
D)  Both One-time and continuous monitoring. 
A)  Only continuous monitoring. 
B)  Only One-time monitoring. 
C)  None of the above. 
D)  Both One-time and continuous monitoring.

Question 8

What options do you get after selecting timeline? (Choose four.)

Accepted Answer

A)  Zoom to selection 
B)  Format Timeline 
C)  Deselect 
D)  Delete 
E)  Zoom Out 
A)  Zoom to selection 
B)  Format Timeline 
C)  Deselect 
D)  Delete 
E)  Zoom Out

Question 9

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Accepted Answer

A)  Cloned panel 
B)  Inline panel 
C)  Report panel 
D)  Prebuilt panel 
A)  Cloned panel 
B)  Inline panel 
C)  Report panel 
D)  Prebuilt panel

Question 10

Which of the following searches will return results where fail, 400, and error exist in every event?

Accepted Answer

A)  error AND (fail AND 400) 
B)  error OR (fail and 400) 
C)  error AND (fail OR 400) 
D)  error OR fail OR 400 
A)  error AND (fail AND 400) 
B)  error OR (fail and 400) 
C)  error AND (fail OR 400) 
D)  error OR fail OR 400

Question 11

Which of the following statements about case sensitivity is true?

Accepted Answer

A)  Both field names and field values ARE case sensitive. 
B)  Field names ARE case sensitive; field values are NOT. 
C)  Field values ARE case sensitive; field names ARE NOT. 
D)  Both field names and field values ARE NOT case sensitive. 
A)  Both field names and field values ARE case sensitive. 
B)  Field names ARE case sensitive; field values are NOT. 
C)  Field values ARE case sensitive; field names ARE NOT. 
D)  Both field names and field values ARE NOT case sensitive.

Question 12

@ Symbol can be used in advanced time unit option.

Accepted Answer

A)  No 
B)  Yes 
A)  No 
B)  Yes

Question 13

Which of the following fields is stored with the events in the index?

Accepted Answer

A)  user 
B)  source 
C)  location 
D)  sourceIp 
A)  user 
B)  source 
C)  location 
D)  sourceIp

Question 14

Which is primary function of the timeline located under the search bar?

Accepted Answer

A)  To differentiate between structured and unstructured events in the data. 
B)  To sort the events returned by the search command in chronological order. 
C)  To zoom in and zoom out, although this does not change the scale of the chart. 
D)  To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime. 
A)  To differentiate between structured and unstructured events in the data. 
B)  To sort the events returned by the search command in chronological order. 
C)  To zoom in and zoom out, although this does not change the scale of the chart. 
D)  To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime.

Question 15

Which of the statements is correct regarding click and drag option in timeline?

Accepted Answer

A)  The new result after selecting the range by dragging filters the events and displays the most recent first. 
B)  There is no functionality like click and drag in Splunk's timeline. 
C)  Using this option executes a new query. 
D)  This doesn't execute a new query. 
A)  The new result after selecting the range by dragging filters the events and displays the most recent first. 
B)  There is no functionality like click and drag in Splunk's timeline. 
C)  Using this option executes a new query. 
D)  This doesn't execute a new query.

Question 16

NOT status = 100:

Accepted Answer

A)  Will display result depending on the data. 
B)  Will return event where status field exist but value of that field is not 100. 
C)  Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist. 
A)  Will display result depending on the data. 
B)  Will return event where status field exist but value of that field is not 100. 
C)  Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

Question 17

Splunk automatically determines the source type for major data types.

Accepted Answer

A) True 
 B)False

Question 18

At index time, in which field does Splunk store the timestamp value?

Accepted Answer

A)  time 
B)  _time 
C)  EventTime 
D)  timestamp 
A)  time 
B)  _time 
C)  EventTime 
D)  timestamp

Question 19

Which of the following statements are correct about Search & Reporting App? (Choose three.)

Accepted Answer

A)  Can be accessed by Apps > Search & Reporting. 
B)  Provides default interface for searching and analyzing logs. 
C)  Enables the user to create knowledge object, reports, alerts and dashboards. 
D)  It only gives us search functionality. 
A)  Can be accessed by Apps > Search & Reporting. 
B)  Provides default interface for searching and analyzing logs. 
C)  Enables the user to create knowledge object, reports, alerts and dashboards. 
D)  It only gives us search functionality.

Question 20

Parsing of data can happen both in HF and Indexer.

Accepted Answer

A)  Only HF 
B)  No 
C)  Yes 
A)  Only HF 
B)  No 
C)  Yes

What happens when a field is added to the Selected Fields list in the fields sidebar?

Data sources being opened and read applies to:

Which of the following Splunk components typically resides on the machines where data originates?

When looking at a dashboard panel that is based on a report, which of the following is true?

What determines the scope of data that appears in a scheduled report?

The new data uploaded in Splunk are shown in ________________.

Monitor option in Add Data provides _______________.

What options do you get after selecting timeline? (Choose four.)

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Which of the following searches will return results where fail, 400, and error exist in every event?

Which of the following statements about case sensitivity is true?

@ Symbol can be used in advanced time unit option.

Which of the following fields is stored with the events in the index?

Which is primary function of the timeline located under the search bar?

Which of the statements is correct regarding click and drag option in timeline?

NOT status = 100:

Splunk automatically determines the source type for major data types.

At index time, in which field does Splunk store the timestamp value?

Which of the following statements are correct about Search & Reporting App? (Choose three.)

Parsing of data can happen both in HF and Indexer.

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Certified Architect

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters

Exam 1: Splunk Core Certified User

What happens when a field is added to the Selected Fields list in the fields sidebar?

Data sources being opened and read applies to:

Which of the following Splunk components typically resides on the machines where data originates?

When looking at a dashboard panel that is based on a report, which of the following is true?

What determines the scope of data that appears in a scheduled report?

The new data uploaded in Splunk are shown in ________________.

Monitor option in Add Data provides _______________.

What options do you get after selecting timeline? (Choose four.)

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Which of the following searches will return results where fail, 400, and error exist in every event?

Which of the following statements about case sensitivity is true?

@ Symbol can be used in advanced time unit option.

Which of the following fields is stored with the events in the index?

Which is primary function of the timeline located under the search bar?

Which of the statements is correct regarding click and drag option in timeline?

NOT status = 100:

Splunk automatically determines the source type for major data types.

At index time, in which field does Splunk store the timestamp value?

Which of the following statements are correct about Search & Reporting App? (Choose three.)

Parsing of data can happen both in HF and Indexer.

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Certified Architect

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters