SPLK-1001 Exam Dumps

Which events will be returned by the following search string?
host=www3 status=503

A. All events that either have a host of www3 or a status of 503.

B. All events with a host of www3 that also have a status of 503

C. We need more information: we cannot tell without knowing the time range

D. We need more information a search cannot be run without specifying an index

When viewing results of a search job from the Activity menu, which of the following is displayed?

A. New events based on the current time range picker

B. The same events based on the current time range picker

C. The same events from when the original search was executed

D. New events in addition to the same events from the original search

Which of the following is the most efficient search?

A. index=* “failed password”

B. “failed password” index=*

C. (index=* OR index=security) “failed password”

D. index=security “failed password”

Field names are case sensitive

A. True

B. False

Which of the following is an accurate definition of fields within Splunk?

A. Inherent entities that exist in event data.

B. A searchable key/value pair in event data.

C. Values pulled exclusively from lookup tables.

D. A non-searchable name/value pair used while indexing data.

What result will you get with following search index=test
sourcetype="The_Questionnaire_P*" ?

A. the_questionnaire _pedia

B. the_questionnaire pedia

C. the_questionnaire_pedia

D. the_questionnaire Pedia