Question 1

Which of the following is the most efficient search?

Options :

A : index=* “failed password”

B : “failed password” index=*

C : (index=* OR index=security) “failed password”

D : index=security “failed password”

Answer: A

Question 2

Select the best options for "search best practices" in Splunk:

(Choose five.)

Options :

A : Select the time range always

B : Try to specify index values.

C : Include as many search terms as possible.

D : Never select time range.

E : Try to use * with every search term

F : Inclusion is generally better than exclusion

G : Try to keep specific search terms.

Answer: A,B,C

Question 3

What are the three main Splunk components?

Options :

A : Search head, GPU, streamer

B : Search head, indexer, forwarder

C : Search head, SQL database, forwarder

D : Search head, SSD, heavy weight agent

Answer: B

Question 4

Which Boolean operator is implied between search terms, unless otherwise specified?

Options :

A : OR

B : AND

C : NOT

D : NAND

Answer: B

Question 5

Which of the following is the most efficient filter for running searches in Splunk?

Options :

A : Time

B : Fast mode

C : Sourcetype

D : Selected Fields

Answer: A

Free SPLK-1001 Mock Exam – Practice Online Confidently