Splunk Fundamentals#1 Study Guide 88 Questions with Answers,100% CORRECT

Splunk Fundamentals#1 Study Guide 88 Questions with Answers Creating Searches and Saving Results: Selected fields are displayed ______each event in the search results. a) below b) interesting fields c) other fie ...

Splunk Fundamentals#1 Study Guide 88 Questions with Answers Creating Searches and Saving Results: Selected fields are displayed ______each event in the search results. a) below b) interesting fields c) other fields d) above - CORRECT ANSWER a) below Creating Searches and Saving Results: Search terms are not case sensitive. a) True b) False - CORRECT ANSWER a) True Creating Searches and Saving Results: These two searches will NOT return the same results. SEARCH 1:login failure SEARCH 2: "login failure". a) True b) False - CORRECT ANSWER a) True Creating Searches and Saving Results: A space is an implied _____ in a search string. a) OR b) AND c) () d) NOT - CORRECT ANSWER b) AND Creating Searches and Saving Results: You can not specify a relative time range, such as 45 seconds ago, for a search. a) True b) False - CORRECT ANSWER b) False Creating Searches and Saving Results: Historical searches provide a static snapshot of events at a given time. a) True b) False - CORRECT ANSWER a) True Creating Searches and Saving Results: Using the export function, you can export a maximum of 2000 results. a) True b) False - CORRECT ANSWER b) False Creating Searches and Saving Results: Which of the following search control will not re-rerun the search? (Select all that apply.) a) zoom out b) selecting a bar on the timeline c) deselect d) selecting a range of bars on the timelines - CORRECT ANSWER b) selecting a bar on the timeline c) deselect d) selecting a range of bars on the timelines Creating Searches and Saving Results: Highlighted search terms indicate _________ search results in Splunk. a)Display as selected fields. b)Sorted c)Charted based on time d)Matching - CORRECT ANSWER d)Matching Creating Searches and Saving Results: The Splunk search language does not support wildcards. a)True b)False - CORRECT ANSWER b)False Creating Searches and Saving Results: The Splunk search language supports the + wildcard. a)True b)False - CORRECT ANSWER b)False Creating Searches and Saving Results: When you mouse over and click to add a search term this (these) Boolean operator(s) is(are) not implied. (Select all that apply). a)OR b)( ) c)AND d)NOT - CORRECT ANSWER b)( ) Creating Searches and Saving Results: The time range specified for a historical search defines the ____________. a)Amount of data shown on the timeline as data streams in b)Amount of data fetched from index matching that time range c)Time range for the static results - CORRECT ANSWER b)Amount of data fetched from index matching that time range Creating Searches and Saving Results: Historical searches provide a static snapshot of events at a given time. a)True b)False - CORRECT ANSWER a)True Creating Searches and Saving Results: Using the export function, you can export search results as __________.( Select all that apply) a)Xml b)Json c)Html d)A php file - CORRECT ANSWER a)Xml b)Json Creating Searches and Saving Results: Using the export function, you can export a maximum of 2000 results. a)True b)False - CORRECT ANSWER b)False Using Fields and Tags: These kinds of fields are identified in you data at INDEX time. a) Data-specific fields b) Default fields - CORRECT ANSWER b) Default fields Using Fields and Tags: Default fields are not added to every event in SPLUNK at INDEX time. a) True b) False - CORRECT ANSWER b) False Using Fields and Tags: The fields sidebar does not show________. (Select all that apply.) a) interesting fields b) selected fields c) all extracted fields - CORRECT ANSWER c) all extracted fields Using Fields and Tags: Field discovery occurs at ___________ time. a) search b) index - CORRECT ANSWER a) search Using Fields and Tags: Only Splunk Administrators can assign selected fields. a) True b) False - CORRECT ANSWER b) False Using Fields and Tags: Fast, optimized and verbose are all selectable search modes. a) True b) False - CORRECT ANSWER b) False Using Fields and Tags: This search user!=*_________________. a) displays only events that contain a value for user b) displays all events c) displays only events that do NOT contain a value for user - CORRECT ANSWER c) displays only events that do NOT contain a value for user Using Fields and Tags: The interesting fields in the fields sidebar is based on what fields you have requested in the past. a)True b)False - CORRECT ANSWER b)False Using Fields and Tags: These 2 searches will return exactly the same results: SEARCH 1:host=www1 SEARCH 2: host=WWW1 a)True b)False - CORRECT ANSWER b)False Using Fields and Tags: These are the default selected fields. a)source, sourcetype, host b)source, sourcetype, index c)source, sourcetype, timestamp d)host, source, _raw - CORRECT ANSWER a)source, sourcetype, host Using Fields and Tags: Which search mode automatically decides how to return fields based on your search? a)Verbose mode b)Fast mode c)Smart mode - CORRECT ANSWER c)Smart mode Using Fields and Tags: These kinds of fields are identified in your data at INDEX time. a)Default fields b)Data-specific fields - CORRECT ANSWER a)Default fields Using Fields and Tags: Which search mode returns all fields? a)Verbose mode b)Fast mode c)Smart mode - CORRECT ANSWER a)Verbose mode Using Fields and Tags: When you run a search, fast mode extracts all fields very quickly. a)True b)False - CORRECT ANSWER b)False Creating Alerts: Splunk alerts can be based on search that run______. (Select all that apply.) a) in real-time b) on a regular schedule c) and have no matching events - CORRECT ANSWER a) in real-time b) on a regular schedule Creating Alerts: Alert throttling is used to _______. a) verify each alert b) stagger search request in a time sequenced order c) stop spamming yourself with alerts d) check severity - CORRECT ANSWER c) stop spamming yourself with alerts Creating Alerts: A real-time alert is ______________. a) A scheduled alert b) constantly running in the background - CORRECT ANSWER b) constantly running in the background Creating Alerts: An alert does not have to trigger every time it generates search results. a)True b)False - CORRECT ANSWER a)True Creating Alerts: Alerts trigger when search results meet specific conditions. a)True b)False - CORRECT ANSWER a)True Creating Alerts: Scheduled alerts must be scheduled to run with cron job syntax only. a)True b)False - CORRECT ANSWER b)False Creating Reports and Visualizations: This tab shows you the event patterns in the results of a specific search. a) statistics b) visualization c) patterns - CORRECT ANSWER c) patterns Creating Reports and Visualizations: Which of the following about reports is/are true? a) Reports are knowledge objects. b) Reports can be scheduled. c) Reports can run a script. d) All of the above. - CORRECT ANSWER d) All of the above. Creating Reports and Visualizations: There is NOT a SAVE AS option when editing a report. a) True b) False - CORRECT ANSWER a) True Creating Reports and Visualizations: Select this in the fields sidebar to automatically pipe you search results to the rare command a) events with this field b) rare values c) top values by time d) top values - CORRECT ANSWER b) rare values Creating Reports and Visualizations: Reports _____ allowing drilldown by default. a)Are b)Are not - CORRECT ANSWER b)Are not Creating Reports and Visualizations: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____. a)skipped or deferred b)automatically accelerated c)deleted d)all of the above - CORRECT ANSWER a)skipped or deferred Creating Reports and Visualizations: Custom charts can be created from the fields sidebar. a)True b)False - CORRECT ANSWER b)False Creating Reports and Visualizations: Which of the following are valid options to speed up reports? (Select all the apply.) a)Edit permissions b)Edit description c)Edit acceleration d)Edit schedule - CORRECT ANSWER c)Edit acceleration Creating Reports and Visualizations: Running a scheduled saved report______. a)Returns the results from the last time the report was saved b)Returns a fresh results set - CORRECT ANSWER b)Returns a fresh results set Using Pivot Tables: Pivot visualizations____________. a) include bubble chart marker gauge and bar chart b) include map scatter chart and pie chart - CORRECT ANSWER a) include bubble chart marker gauge and bar chart Using Pivot Tables: After you create a pivot you can save it as a __________. (Select all that apply.) a) tag b) eventtype c) report d) dashboard panel - CORRECT ANSWER c) report d) dashboard panel Using Pivot Tables: Pivot editor enables users to quickly reports but they must use the pivot command.' a)True b)False - CORRECT ANSWER b)False Using Pivot Tables: The pivot editor has a map visualization option. a)True b)False - CORRECT ANSWER b)False Using Pivot Tables: New pivots automatically populate with __________ (Select all that apply). a)Split rows b)Split columns c)Count of hosts d)Time range filter - CORRECT ANSWER d)Time range filter Search Fundamentals: The following searches will return the same results. SEARCH 1: ssh error SEARCH 2: ssh AND error a) True b) False - CORRECT ANSWER a) True Search Fundamentals: Field names are case ___________. a) sensitive b) insensitive - CORRECT ANSWER a) sensitive Search Fundamentals: Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* | fields action productld status a) is looking for all events that include the search terms: fields AND action AND productld AND status b) uses the table command to improve performance c) limits the fields are extracted d) returns a table with 3 columns - CORRECT ANSWER b) uses the table command to improve performance c) limits the fields are extracted Search Fundamentals: Internal fields, such as _raw and _time, can be explicitly removed from results with fields command. a) True b) False - CORRECT ANSWER b) False Search Fundamentals: Use the dedup command to _____. a)Rename a field in the index b)remove duplicate values c)provide an additional alias for the field that can d)be used in the search criteria - CORRECT ANSWER b)remove duplicate values Search Fundamentals: The following searches will not return the same results. SEARCH 1: purchase SEARCH 2: action=purchase a)True b)False - CORRECT ANSWER a)True Search Fundamentals: We can use the rename command to _____ (Select all that apply.) a)Change indexed fields b)Exclude fields from our search results c)Extract new fields from our data using regular expressions d)Give a field a new name at search time - CORRECT ANSWER d)Give a field a new name at search time Getting Statistics: The limit attribute will___________. a) override default of 10 b) only work with top command c) override default of 20 d) override default of 15 - CORRECT ANSWER a) override default of 10 Getting Statistics: This function of the stats command allows you to identify the number of values a field has. a) max b) distinct_count c) fields d) count - CORRECT ANSWER d) count Getting Statistics: This function of the stats command allows you to return the sample standard deviation of a field. a) stdev b) dev c) count deviation d) by standarddev - CORRECT ANSWER a) stdev Getting Statistics: Which of the following commands will show the maximum bytes? a) sourcetype=access_* | maximum totals by bytes b) sourcetype=access_* | avg (bytes) c) sourcetype=access_* | stats max(bytes) d) sourcetype=access_* | max(bytes) - CORRECT ANSWER c) sourcetype=access_* | stats max(bytes) Getting Statistics: This search will return 20 results. SEARCH: error | top host limit = 20 a)True b)False - CORRECT ANSWER a)True Getting Statistics: Which of the following searches will show the number of categoryld used by each host? a)Sourcetype=access_* |sum bytes by host b)Sourcetype=access_* |stats sum(categoryld) by host c)Sourcetype=access_* |sum(bytes) by host d)Sourcetype=access_* |stats sum by host - CORRECT ANSWER b)Sourcetype=access_* |stats sum(categoryld) by host Getting Statistics: This clause is used to group the output of a stats command by a specific name. a)Rex b)As c)List d)By - CORRECT ANSWER b)As Getting Statistics: This function of the stats command allows you to return the middle-most value of field X. Median(X) Eval by X Fields(X) Values(X) - CORRECT ANSWER Median(X) Creating Visualizations: When a search returns __________, you can view the results as a list. a) a list of events b) transactions c) statistical values - CORRECT ANSWER c) statistical values Creating Visualizations: Clicking a SEGMENT on a chart, ________. a) drills down for that value b) highlights the field value across the chart c) adds the highlighted value to the search criteria - CORRECT ANSWER c) adds the highlighted value to the search criteria Correlating Events, Enriching Data with Lookups, and Accelerating Reports: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar. a) inputlookup b) lookup - CORRECT ANSWER b) lookup Correlating Events, Enriching Data with Lookups, and Accelerating Reports: 36. Lookups can be private for a user. a) True b) False - CORRECT ANSWER a) True Correlating Events, Enriching Data with Lookups, and Accelerating Reports: In automatic lookup definitions, the _____ fields are those that are not in the event data. a) input b) output - CORRECT ANSWER b) output Correlating Events, Enriching Data with Lookups, and Accelerating Reports: What is the correct order of steps for creating a new lookup? A. Configure the lookup to run automatically B. Create the lookup table C. Define the lookup a) B, A, C b) A, B, C c) B, C, A d) C, B, A - CORRECT ANSWER c) B, C, A Correlating Events, Enriching Data with Lookups, and Accelerating Reports: The command shown here does witch of the following: Command: |outputlookup products.csv a)Writes search results to a file named products.csv b)Returns the contents of a file named products.csv - CORRECT ANSWER a)Writes search results to a file named products.csv Correlating Events, Enriching Data with Lookups, and Accelerating Reports: Which of the following are not true about lookups? (Select all that apply.) a)Lookups can be time based b)Search results can be used to populate a lookup table c)Splunk DB Connect can be used to populate a lookup table from relational databases d)Output from a script can be used to populate a lookup table e)Lookup have a 10mg maximum size limit - CORRECT ANSWER e)Lookup have a 10mg maximum size limit Correlating Events, Enriching Data with Lookups, and Accelerating Reports: Lookups allow you to overwrite your raw event. a)True b)False - CORRECT ANSWER a)True Correlating Events, Enriching Data with Lookups, and Accelerating Reports: It is mandatory for the lookup file to have this for an automatic lookup to work. a)Source type b)At least five columns c)Timestamp d)Input field - CORRECT ANSWER d)Input field The Common Information Model and Working with Fields: By default, all users have DELETE permission to ALL knowledge objects. a) True b) False - CORRECT ANSWER b) False The Common Information Model and Working with Fields: These users can create global knowledge objects. (Select all that apply.) a) users b) power users c) administrators - CORRECT ANSWER b) power users c) administrators The Common Information Model and Working with Fields: All users by default have WRITE permission to ALL knowledge objects. a)True b)False - CORRECT ANSWER b)False Creating Data Models: Object ATTRIBUTES do not define ___________. a) a base search for the object b) fields for the object - CORRECT ANSWER a) a base search for the object Creating Data Models: Fields associated with a data set are known as ______. a)Attributes b)Constraints - CORRECT ANSWER a)Attributes Splunk Components: Which of the following are responsible for reducing search results? a) search heads b) indexers c) forwarders - CORRECT ANSWER b) indexers Splunk Components: Which of the following are responsible for parsing incoming data and storing data on disc? a) forwarders b) indexers c) search heads - CORRECT ANSWER b) indexers Getting Data In: This is what Splunk uses to categorize the data that is being indexed. a) sourcetype b) index c) source d) host - CORRECT ANSWER a) sourcetype Getting Data In: This is what Splunk uses to categorize the data that is being indexed. a)Host b)Sourcetype c)Index d)Source - CORRECT ANSWER b)Sourcetype How Splunk Scales: It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine data. a)True b)False - CORRECT ANSWER b)False How Splunk Scales: It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine data. a)True b)False - CORRECT ANSWER b)False How Splunk Scales: By default search results are not returned in ________ order. a)Chronological b)Reverser chronological c)ASCIE d)Alphabetical - CORRECT ANSWER a)Chronological d)Alphabetical The stats command will create a _____________ by default. a)Table b)Report c)Pie chart - CORRECT ANSWER a)Table