Question 1

In Splunk terminology, what is an index?

Options :

A : A data repository that contains raw, compressed data along with psidx files.

B : A data repository that contains raw, compressed data along with tsidx files.

C : A data repository that contains raw, uncompressed data along with psidx files.

D : A data repository that contains raw, uncompressed data along with tsidx files.

Answer: B

Question 2

If a new event's raw data contains a timestamp, what is the next check (or decision) that Splunk makes in the event timestamp processing logic?

Options :

A : Check if explicit time extraction rules exist in props.conf.

B : Check if the event contains a date.

C : Check if the file name contains a date.

D : Check if timestamps of nearby events from the same source are within a ten minute offset.

Answer: A

Question 3

Which option can be used to specify the host value of the data when creating a file or directory monitor input?

Options :

A : Select Host

B : Define Host

C : Choose Host

D : Set Host

Answer: D

Question 4

Which of the following are default Splunk Cloud user roles?

Options :

A : must_delete, power, sc_admin

B : power, user, admin

C : apps, power, sc_admin

D : can delete, users, admin

Answer: B

Question 5

In which of the following situations should Splunk Support be contacted?

Options :

A : When a custom search needs tuning due to not performing as expected.

B : When an app on Splunkbase indicates Request Install.

C : Before using the delete command.

D : When a new role that mirrors sc_admin is required.

Answer: B

Free SPLK-1005 Mock Exam – Practice Online Confidently