Question 1

At the time of searching the start time is 03:35:08.

Will it look back to 03:00:00 if we use -30m@h in searching?

Options :

A : Yes

B : No

Answer: A

Question 2

What is the proper SPL terminology for specifying a particular index in a search?

Options :

A : indexer—index_name

B : indexer name—index_name

C : index=index_name

D : index name=index_name

Answer: C

Question 3

Which statement describes field discovery at search time?

Options :

A : Splunk automatically discovers only numeric fields

B : Splunk automatically discovers only alphanumeric fields

C : Splunk automatically discovers only manually configured fields

D : Splunk automatically discovers only fields directly related to the search results

Answer: D

Question 4

What are the two most efficient search filters?

Options :

A : . _time and host

B : _time and index

C : host and sourcetype

D : index and sourcetype

Answer: B

Question 5

By default, all users have DELETE permission to ALL knowledge objects.

Options :

A : True

B : False

Answer: B

Free SPLK-1001 Mock Exam – Practice Online Confidently