After running a search, what effect does clicking and dragging across the timeline have?
AExecutes a new search.
BFilters current search results.
CMoves to past or future events.
DExpands the time range of the search.
How do you add or remove fields from search results?
AUse field +to add and field -to remove.
BUse table +to add and table -to remove.
CUse fields +to add and fields ג€"to remove.
DUse fields Plus to add and fields Minus to remove.
How can search results be kept longer than 7 days?
ABy scheduling a report.
BBy creating a link to the job.
CBy changing the job settings.
DBy changing the time range picker to more than 7 days.
When displaying results of a search, which of the following is true about line charts?
ALine charts are optimal for single and multiple series.
BLine charts are optimal for single series when using Fast mode.
CLine charts are optimal for multiple series with 3 or more columns.
DLine charts are optimal for multiseries searches with at least 2 or more columns.
What is one benefit of creating dashboard panels from reports?
AAny newly created dashboard will include that report.
BThere are no benefits to creating dashboard panels from reports.
CIt makes the dashboard more efficient because it only has to run one search string.
DAny change to the underlying report will affect every dashboard that utilizes that report.
By default, which of the following fields would be listed in the fields sidebar under interesting Fields?
Ahost
Bindex
Csource
Dsourcetype
What does the values function of the stats command do?
ALists all values of a given field.
BLists unique values of a given field.
CReturns a count of unique values for a given field.
DReturns the number of events that match the search.
What is the main requirement for creating visualizations using the Splunk UI?
AYour search must transform event data into Excel file format first.
BYour search must transform event data into XML formatted data first.
CYour search must transform event data into statistical data tables first.
DYour search must transform event data into JSON formatted data first.
Which of the following searches will return results where fail, 400, and error exist in every event?
Aerror AND (fail AND 400)
Berror OR (fail and 400)
Cerror AND (fail OR 400)
Derror OR fail OR 400
Which of the following is the most efficient filter for running searches in Splunk?
ATime
BFast mode
CSourcetype
DSelected Fields
Which of the following file types is an option for exporting Splunk search results?
APDF
BJSON
CXLS
DRTF
Which search would return events from the access_combined sourcetype?
ASourcetype=access_combined
BSourcetype=Access_Combined
Csourcetype=Access_Combined
DSOURCETYPE=access_combined
Which of the following index searches would provide the most efficient search performance?
Aindex=*
Bindex=web OR index=s*
C(index=web OR index=sales)
Dindex=sales AND index=web
In the Splunk interface, the list of alerts can be filtered based on which characteristics?
AApp, Owner, Severity, and Type
BApp, Owner, Priority, and Status
CApp, Dashboard, Severity, and Type
DApp, Time Window, Type, and Severity
What does the following specified time range do?
earliest=-72h@h latest=@d
ALook back 3 days ago and prior.
BLook back 72 hours, up to one day ago.
CLook back 72 hours, up to the end of today.
DLook back from 3 days ago, up to the beginning of today.
You can use the following options to specify start and end time for the query range:
Aearliest=
Blatest=
Cbeginning=
Dending=
EAll the above
FOnly 3rd and 4th
Which search will return only events containing the word error and display the results as a table that includes the fields named action, src, and dest?