Splunk Core Certified User - SPLK-1001 Exam Practice Test

A. 1, 2, 3

B. 2, 1, 3

C. 3, 2, 1

D. 2, 3, 1

A. After saving the report, click Scheduling.

B. After saving the report, click Schedule.

C. After saving the report, click Dashboard Panel.

D. After saving the report, click Event Type.

A. sourcetype=firewall | rare limit=15 dest_ip

B. sourcetype=firewall | rare count=15 dest_ip

C. sourcetype=firewall | rare num=15 dest_ip

D. sourcetype=firewall | rare last=15 dest_ip

A. Saving the item to a report

B. Adding the item to a dashboard

C. Saving the search to a JSON file.

D. Adding the item to the search.

A. 443

B. 8089

C. 8000

D. 8080

A. Add an output.

B. Drag a dashboard panel to a different location on the dashboard.

C. Modify the chart type displayed in a dashboard panel.

D. Export a dashboard panel.

A. Only searches that generate statistics or visualizations

B. Only searches containing a transforming command

C. Only searches that generate visualizations

D. Any search can be saved as a report

A. stats vendor_action (count)

B. stats count (vendor_action)

C. count stats vendor_action

D. count stats (vendor_action)

A. clientip

B. action

C. sourcetype

D. categoryld

A. Will display result depending on the data.

B. Will return event where status field exist but value of that field is not 100.

C. Will return event where status field exist but value of that field is not 100 and all events where status field