Practice SPLK-2001 Exam Online

Question 1

There is a global search named “global_search” defined on a form as shown below:

<query>

index-_internal source-*splunkd.log | stats count by component, log_level

</query>

</search>

Which of the following would be a valid post-processing search? (Select all that apply.)

A : | tstats count

B : sourcetype=mysourcetype

C : stats sum(count) AS count by log level

D : search log_level=error | stats sum(count) AS count by component

Answer: C,D

Question 2

Which Splunk REST endpoint is used to create a KV store collection?

A : /storage/collections

B : /storage/kvstore/create

C : /storage/collections/config

D : /storage/kvstore/collections

Answer: A

Question 3

Data can be added to a KV store collection in which of the following format(s)?

A : JSON

B : JSON, XML

C : JSON, XML, CSV

D : JSON, XML, CSV, TXT

Answer: A

Question 4

For a KV store, a lookup stanza in the transforms.conf file must contain which of the following? (Select all that apply.)

A : collection

B : fields_list

C : external_type

D : internal_type

Answer: A,B

Question 5

When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

A : Use a generating search

B : Remove unneeded fields.

C : Truncate the data, using selective functions

D : Summarize data, using analytic commands.

Answer: A,B

Name:	Splunk Certified Developer
Exam Code:	SPLK-2001
Certification:	Splunk Certified Developer
Vendor:	Splunk
Total Questions:	72
Last Updated:	Apr 24, 2024

Splunk SPLK-2001