Practice SPLK-1001 Exam Online

Question 1

Which of the following is an option after clicking an item in search results?

A : Saving the item to a report

B : Adding the item to the search.

C : Adding the item to a dashboard

D : Saving the search to a JSON file.

Answer: A

Question 2

After running a search, what effect does clicking and dragging across the timeline have?

A : Executes a new search

B : Filters current search results.

C : Moves to past or future events

D : Expands the time range of the search.

Answer: B

Question 3

What is the primary use for the rare command1?

A : To sort field values in descending order

B : To return only fields containing five or fewer values

C : To find the least common values of a field in a dataset

D : To find the fields with the fewest number of values across a dataset

Answer: C

Question 4

By default, all users have DELETE permission to ALL knowledge objects.

A : True

B : False

Answer: B

Question 5

Select the best options for "search best practices" in Splunk:

(Choose five.)

A : Select the time range always

B : Try to specify index values.

C : Include as many search terms as possible.

D : Never select time range.

E : Try to use * with every search term

F : Inclusion is generally better than exclusion

G : Try to keep specific search terms.

Answer: A,B,C

Splunk SPLK-1001