SPLK-1001 Exam Questions - Splunk Core Certified User

SPLK-1001 Splunk Core Certified User is a recommended entry-level certification track for all candidates. PassQuestion latest Splunk Fundamentals SPLK-1001 Exam Questions are your best choice to pass your test easily,you can find all the topics included. All SPLK-1001 questions and answers are written in high standard of technical accuracy by certified experts from PassQuestion and ensure you pass your Splunk Core Certified User exam successfully.

SPLK-1001 Exam Description - Splunk Core Certified User 

The Splunk Core Certified User exam is the final step towards completion of the Splunk Core Certified User certification.This entry-level certification exam is a 57-minute, 65-question assessment which evaluates a candidate's knowledge and skills to search, use fields, create alerts, use lookups, and create basic statistical reports and dashboards. Candidates can expect an additional 3 minutes to review the exam agreement, for a total seat time of 60 minutes. This optional entry-level certification demonstrates an individual's basic ability to navigate and use Splunk software.

Splunk SPLK-1001 General Guidelines Included On The Exam:

● Introduction to Splunk's interface
● Basic searching
● Using fields in searches
● Search fundamentals
● Transforming commands
● Creating reports and dashboards
● Creating and using lookups
● Scheduled reports
● Alerts
● Using Pivot

The following content categories and objectives provide more specific guidance for the purpose of exam
composition; 
1.0 Splunk Basics   5%
2.0 Basic Searching   22%
3.0 Using Fields in Searches   20%
4.0 Search Language Fundamentals   15%
5.0 Using Basic Transforming Commands   15%
6.0 Creating Reports and Dashboards   12%
7.0 Creating and Using Lookups   6%
8.0 Creating Scheduled Reports and Alerts   5%

View Online Splunk Core Certified User SPLK-1001 Free Questions

1.Which search string only returns events from hostWWW3?
A. host=*
B. host=WWW3
C. host=WWW*
D. Host=WWW3
Answer: B

2.By default, how long does Splunk retain a search job?
A. 10 Minutes
B. 15 Minutes
C. 1 Day
D. 7 Days
Answer: A
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Extendjoblifetimes

3.What must be done before an automatic lookup can be created? (Choose all that apply.)
A. The lookupcommand must be used.
B. The lookup definition must be created.
C. The lookup file must be uploaded to Splunk.
D. The lookup file must be verified using the inputlookupcommand.
Answer: B
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/ DefineanautomaticlookupinSplunkWeb

4.Which of the following Splunk components typically resides on the machines where data originates?
A. Indexer
B. Forwarder
C. Search head
D. Deployment server
Answer: C

5.What determines the scope of data that appears in a scheduled report?
A. All data accessible to the User role will appear in the report.
B. All data accessible to the owner of the report will appear in the report.
C. All data accessible to all users will appear in the report until the next time the report is run.
D. The owner of the report can configure permissions so that the report uses either the User role or the owner’s profile at run time.
Answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Report/Managereportpermissions

6.When writing searches in Splunk, which of the following is true about Booleans?
A. They must be lowercase.
B. They must be uppercase.
C. They must be in quotations.
D. They must be in parentheses.
Answer: B

7.Which of the following searches would return events with failure in index netfw or warn or criticalin index netops?
A. (index=netfw failure) AND index=netops warn OR critical
B. (index=netfw failure) OR (index=netops (warn OR critical))
C. (index=netfw failure) AND (index=netops (warn OR critical))
D. (index=netfw failure) OR index=netops OR (warn OR critical)
Answer: B