Question 1

When an alert action is configured to run a script, Splunk must be able to locate the script. Which is one of the directories Splunk will look in to find the script?
A) $SPLUNK_HOME/bin/scripts
B) $SPLUNK_HOME/etc/scripts
C) $SPLUNK_HOME/bin/etc/scripts
D) $SPLUNK_HOME/etc/scripts/bin

Accepted Answer

Splunk looks for scripts in the $SPLUNK_HOME/bin/scripts directory when an alert action is configured to run a script.

Question 2

What does the rare command do?
A) Returns the least common field values of a given field in the results.
B) Returns the most common field values of a given field in the results.
C) Returns the top 10 field values of a given field in the results.
D) Returns the lowest 10 field values of a given field in the results.

Accepted Answer

The rare command is used to return the least common field values of a given field in the results.

Question 3

What must be done in order to use a lookup table in Splunk?
A) The lookup must be configured to run automatically.
B) The contents of the lookup file must be copied and pasted into the search bar.
C) The lookup file must be uploaded to Splunk and a lookup definition must be created.
D) The lookup file must be uploaded to the etc/apps/lookups folder for automatic ingestion.

Accepted Answer

To use a lookup table in Splunk, the lookup file must be uploaded to Splunk, and a lookup definition must be created to define how the lookup is used in searches.

Question 4

When writing searches in Splunk, which of the following is true about Booleans?
A) They must be lowercase.
B) They must be uppercase.
C) They must be in quotations.
D) They must be in parentheses.

Accepted Answer

In Splunk, Boolean operators such as AND, OR, and NOT must be written in uppercase to be recognized as operators.

Question 5

After running a search, what effect does clicking and dragging across the timeline have?
A) Executes a new search.
B) Filters current search results.
C) Moves to past or future events.
D) Expands the time range of the search.

Accepted Answer

The answer of After running a search, what effect does...

Question 6

When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?
A) |
B) $
C) !
D) ,

Accepted Answer

The comma (,) delimiter is used to separate field names in the sort command when sorting on multiple fields in a search.

Question 7

Which Boolean operator is always implied between two search terms, unless otherwise specified?
A) OR
B) NOT
C) AND
D) XOR

Accepted Answer

The Boolean operator "AND" is typically implied between two search terms in search engines and databases, meaning both terms must be present in the results.

Question 8

What is the correct syntax to count the number of events containing a vendor_action field?
A) count stats vendor_action
B) count stats (vendor_action)
C) stats count (vendor_action)
D) stats vendor_action (count)

Accepted Answer

The correct syntax to count the number of events containing a specific field in Splunk is "stats count (vendor_action)".

Question 9

Which time range picker configuration would return real-time events for the past 30 seconds?
A) Preset - Relative: 30-seconds ago
B) Relative - Earliest: 30-seconds ago, Latest: Now
C) Real-time - Earliest: 30-seconds ago, Latest: Now
D) Advanced - Earliest: 30-seconds ago, Latest: Now

Accepted Answer

Real-time configuration with earliest set to 30-seconds ago and latest set to now will continuously update and show events as they occur in real-time for the past 30 seconds.

Question 10

Which search string only returns events from hostWWW3?
A) host=*
B) host=WWW3
C) host=WWW*
D) Host=WWW3

Accepted Answer

host=WWW3 will only return events from hostWWW3.

Question 11

Which of the following statements about case sensitivity is true?
A) Both field names and field values ARE case sensitive.
B) Field names ARE case sensitive; field values are NOT.
C) Field values ARE case sensitive; field names ARE NOT.
D) Both field names and field values ARE NOT case sensitive.

Accepted Answer

The answer of Which of the following statements about case...

Question 12

Which of the following represents the Splunk recommended naming convention for dashboards?
A) Description_Group_Object
B) Group_Description_Object
C) Group_Object_Description
D) Object_Group_Description

Accepted Answer

Splunk recommends the naming convention "Group_Object_Description" for dashboards to ensure clarity and consistency.

Question 13

Which of the following are common constraints of the top command?
A) limit, count
B) limit, showpercent
C) limits, countfield
D) showperc, countfield

Accepted Answer

The common constraints of the top command are "limit" and "count," which are used to control the number of results displayed.

Question 14

What syntax is used to link key/value pairs in search strings?
A) action+purchase
B) action=purchase
C) action | purchase
D) action equal purchase

Accepted Answer

The correct syntax for linking key/value pairs in search strings is "key=value".

Question 15

Which statement is true about Splunk alerts?
A) Alerts are based on searches that are either run on a scheduled interval or in real-time.
B) Alerts are based on searches and when triggered will only send an email notification.
C) Alerts are based on searches and require cron to run on scheduled interval.
D) Alerts are based on searches that are run exclusively as real-time.

Accepted Answer

Splunk alerts are based on searches that can be configured to run on a scheduled interval or in real-time, allowing for flexibility in monitoring and alerting.

Question 16

By default, how long does Splunk retain a search job?
A) 10 Minutes
B) 15 Minutes
C) 1 Day
D) 7 Days

Accepted Answer

The answer of By default, how long does Splunk retain...

Question 17

A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?
A) Click All Fields and select the field to add it to Selected Fields.
B) Click Interesting Fields and select the field to add it to Selected Fields.
C) Click Selected Fields and select the field to add it to Interesting Fields.
D) This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.

Accepted Answer

To add a field to the fields sidebar, you can click on "All Fields" and select the field to add it to "Selected Fields".

Question 18

When editing a dashboard, which of the following are possible options? (Choose all that apply.)
A) Add an output.
B) Export a dashboard panel.
C) Modify the chart type displayed in a dashboard panel.
D) Drag a dashboard panel to a different location on the dashboard.

Accepted Answer

The answer of When editing a dashboard, which of the...

Question 19

Which stats command function provides a count of how many unique values exist for a given field in the result set?
A) dc(field)
B) count(field)
C) count-by(field)
D) distinct-count(field)

Accepted Answer

The "dc(field)" function is used to provide a count of how many unique values exist for a given field in the result set.

Question 20

Which of the following is a Splunk search best practice?
A) Filter as early as possible.
B) Never specify more than one index.
C) Include as few search terms as possible.
D) Use wildcards to return more search results.

Accepted Answer

Filtering as early as possible reduces the amount of data that needs to be processed, making the search more efficient.

Exam 1: Splunk Core Certified User

When an alert action is configured to run a script, Splunk must be able to locate the script. Which is one of the directories Splunk will look in to find the script?

What does the rare command do?

What must be done in order to use a lookup table in Splunk?

When writing searches in Splunk, which of the following is true about Booleans?

After running a search, what effect does clicking and dragging across the timeline have?

When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

Which Boolean operator is always implied between two search terms, unless otherwise specified?

What is the correct syntax to count the number of events containing a vendor_action field?

Which time range picker configuration would return real-time events for the past 30 seconds?

Which search string only returns events from hostWWW3?

Which of the following statements about case sensitivity is true?

Which of the following represents the Splunk recommended naming convention for dashboards?

Which of the following are common constraints of the top command?

What syntax is used to link key/value pairs in search strings?

Which statement is true about Splunk alerts?

By default, how long does Splunk retain a search job?

A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?

When editing a dashboard, which of the following are possible options? (Choose all that apply.)

Which stats command function provides a count of how many unique values exist for a given field in the result set?

Which of the following is a Splunk search best practice?