SPLK-1004 Practice Exam — 95 Free Splunk Questions

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

95Practice Questions

3Study Modes

Free

TopicSort

Question 1

Creating and Using Workflow Actions

What default Splunk role can use the Log Event alert action?

A Power
B User
C can_delete
D Admin

Question 2

Creating Data Models

Question 3

Creating and Using Macros

Question 4

Creating and Managing Fields

Question 5

Creating and Using Workflow Actions

Question 6

Filtering and Formatting Results

Question 7

Filtering and Formatting Results

Question 8

Using Transforming Commands for Visualizations

Question 9

Filtering and Formatting Results

Question 10

Creating Field Aliases and Calculated Fields

Question 11

Filtering and Formatting Results

Question 12

Creating and Managing Fields

Question 13

Using Transforming Commands for Visualizations

Question 14

Creating Field Aliases and Calculated Fields

Question 15

Creating Tags and Event Types

Question 16

Creating and Managing Fields

Question 17

Filtering and Formatting Results

Question 18

Filtering and Formatting Results

Question 19

Creating Tags and Event Types

Question 20

Using Transforming Commands for Visualizations

Question 21

Filtering and Formatting Results

Question 22

Creating and Managing Fields

Question 23

Creating Field Aliases and Calculated Fields

Question 24

Using Transforming Commands for Visualizations

Question 25

Filtering and Formatting Results

Page 1 of 4 • Questions 1-25 of 95

1 2 3 4

→

Know a question that should be here? Contribute to this exam

What qualifies a report for acceleration?

A Fewer than 100k events in search results, with transforming commands used in the search string.
B More than 100k events in search results, with only a search command in the search string.
C More than 100k events in the search results, with a search and transforming command used in the search string.
D Fewer than 100k events in search results, with only a search and transaction command used in the search string.

If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?

A Double tick marks around the nested macro.
B A comma before the nested macro.
C Square brackets around the nested macro.
D A pipe character before the nested macro.

Which of the following are potential string results returned by the typeof function?

A True, False, Unknown
B Number, String, Bool
C Number, String, Null
D Field, Value, Lookup

What capability does a power user need to create a Log Event alert action?

A edit_search_server
B edit_udp
C edit_tcp
D edit_alerts

Question 6

Filtering and Formatting Results

Question 7

Filtering and Formatting Results

Question 8

Using Transforming Commands for Visualizations

Question 9

Filtering and Formatting Results

Question 10

Creating Field Aliases and Calculated Fields

Question 11

Filtering and Formatting Results

Question 12

Creating and Managing Fields

Question 13

Using Transforming Commands for Visualizations

Question 14

Creating Field Aliases and Calculated Fields

Question 15

Creating Tags and Event Types

Question 16

Creating and Managing Fields

Question 17

Filtering and Formatting Results

Question 18

Filtering and Formatting Results

Question 19

Creating Tags and Event Types

Question 20

Using Transforming Commands for Visualizations

Question 21

Filtering and Formatting Results

Question 22

Creating and Managing Fields

Question 23

Creating Field Aliases and Calculated Fields

Question 24

Using Transforming Commands for Visualizations

Question 25

Filtering and Formatting Results

Which of the following statements is accurate regarding the append command?

A It is used with a subsearch and only accesses real-time searches.
B It is used with a subsearch and only accesses historical data.
C It cannot be used with a subsearch and only accesses historical data.
D It cannot be used with a subsearch and only accesses real-time searches.

When and where do search debug messages appear to help with troubleshooting views?

A In the Dashboard Editor, while the search is running.
B In the Search Job Inspector, after the search completes.
C In the Search Job Inspector, while the search is running.
D In the Dashboard Editor, after the search completes.

How can the Inspect button be disabled on a dashboard panel?

A Set inspect.link.disabled to 1
B Set link.inspect.visible to 0
C Set link.inspect.Search.visible to 0
D Set link.search.disabled to 1

Assuming a standard time zone across the environment, what syntax will always return events from between 2:00am and 5:00am?

A date hour>=2 AND date_hour<5
B earliest==2h@h AND latests-5h@h
C time_hour>=2 AND time_hour>=5
D earliest-2h@h AND latest=5h@h

Which function of the stats command creates a multivalue entry?

A mvecombine
B eval
C makemv
D list

A report named "Linux logins" populates a summary index with the search string sourcetype=linux secure | sitop src ip user. Which of the following correctly searches against the summary index for this data?

A index=summary sourcetype="linux_secure" | top src_ip user
B index=summary search name="Linux logins" | top src ip user
C index=summary search_name="Linux logins" | stats count by src_ip user
D index=summary sourcetype="linux secure" | stats count by src_ip user

What is returned when Splunk finds fewer than the minimum matches for each lookup value?

A The default value NULL until the minimum match threshold is reached.
B The default match value until the minimum match threshold is reached.
C The first match unless the time_field attribute is specified.
D Only the first match.

What arguments are required when using the spath command?

A input, output, index
B input, output, path
C No arguments are required.
D field, host, source

Which statement about the coalesce function is accurate?

A It can take only a single argument.
B It can take a maximum of two arguments.
C It can be used to create a new field in the results set.
D It can return null or non-null values.

Which field is required for an event annotation?

A annotation category
B _time
C eventtype
D annotation label

How is a multivalue field created from product="a,b,c,d"?

A ...| makemv delim(product, ",")
B ...| eval mvexpand(makemv(product, ","))
C ...| mvexpand product
D ...| makemv delim="," product

What does the query | makeresults generate?

A A timestamp
B A results field
C An error message
D The results of the previously run search

Which of the following functions' primary purpose is to convert epoch time to a string format?

A tostring
B strptime
C tonumber
D strftime

Which element attribute is required for event annotation?

A <search type="event_annotation">
B <search style="annotation">
C <search type=$annotation$>
D <search type="annotation">

Which predefined drilldown token passes a clicked value from a table row?

A $rowclick.<fieldname>$
B $tableclick.<fieldname>$
C $row.<fieldname>$
D $table.<fieldname>$

Which of the following would exclude all entries contained in the lookup file baditems.csv from search results?

A NOT [inputlookup baditems.csv]
B NOT (lookup baditems.csv OUTPUT item)
C WHERE item NOT IN (baditems.csv)
D [NOT input.lookup baditems.csv]

Which of the following best describes the process for tokenizing event data?

A The event data is broken up by values in the punct field.
B The event data is broken up by major breakers and then broken up further by minor breakers.
C The event data is broken up by a series of user-defined regex patterns.
D The event data has all punctuation stripped out and is then space delimited.

Which of the following is valid syntax for the split function?

A | eval split phoneNumber by “-“ as areaCode
B | eval areaCodes - split(phoneNumber, “-“)
C | eval phoneNumber split(“-“, 3, areaCodes)
D | eval split(phoneNumber, “-“, areaCodes)

When would a distributable streaming command be executed on an indexer?

A If any of the preceding search commands are executed on the search head.
B If all preceding search commands are executed on the indexer, and a streamstats command is used.
C If all preceding search commands are executed on the indexer.
D If some of the preceding search commands are executed on the indexer, and a timechart command is used.

Where can wildcards be used in the tstats command?

A No wildcards can be used with tstats.
B In the where clause.
C In the from clause.
D In the by clause.

Join Us Among the Stars

SPLK-1004Preview

About the SPLK-1004 Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25