最新的Splunk SPLK-1001免費考試真題

問題1

By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

A. index

B. source

C. host

D. sourcetype

正確答案: D

說明：（僅 Fast2test 成員可見）

問題2

What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

A. latest=-2hour@d

B. latest=-2h

C. earliest=-2hour@d

D. earliest=-2h

正確答案: D

說明：（僅 Fast2test 成員可見）

問題3

The command shown here does witch of the following: Command: |outputlookup products.csv

A. Writes search results to a file named products.csv

B. Returns the contents of a file named products.csv

正確答案: A

問題4

What is the main requirement for creating visualizations using the Splunk UI?

A. Your search must transform event data into statistical data tables first.

B. Your search must transform event data into XML formatted data first.

C. Your search must transform event data into Excel file format first.

D. Your search must transform event data into JSON formatted data first.

正確答案: A

問題5

When writing searches in Splunk, which of the following is true about Booleans?

A. They must be uppercase.

B. They must be lowercase.

C. They must be in quotations.

D. They must be in parentheses.

正確答案: A

問題6

_______________ transforms raw data into events and distributes the results into an index.

A. Forwarder

B. Indexer

C. Index

D. Search Head

正確答案: B

問題7

Which is a primary function of the timeline located under the search bar?

A. To zoom in and zoom out. although this does not change the scale of the chart

B. To sort the events returned by the search command in chronological order

C. To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime

D. To differentiate between structured and unstructured events in the data

正確答案: C

問題8

Which of the following reports is available in the Fields window?

A. Events with rare value fields

B. Events with top value fields

C. Top values by time

D. Rare values by time

正確答案: B

問題9

What must be done in order to use a lookup table in Splunk?

A. The lookup must be configured to run automatically.

B. The contents of the lookup file must be copied and pasted into the search bar.

C. The lookup file must be uploaded to Splunk and a lookup definition must be created.

D. The lookup file must be uploaded to the etc/apps/lookups folder for automatic ingestion.

正確答案: C

問題10

Where does Licensing meter happen?

A. Indexer

B. Parsing

C. Heavy Forwarder

D. Input

正確答案: A

問題11

When refining search results, what is the difference in the time picker between real-time and relative time ranges?

A. Real-time searches run constantly in the background, while relative searches only run when certain criteria are met.

B. Real-time searches happen instantly, while relative searches happen at a scheduled time.

C. Real-time searches display results from a rolling time window, while relative searches display results from a set length of time.

D. Real-time represents events that have happened in a set time window, while relative will display results from a rolling time window.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題12

What is the purpose of using a by clause with the stats command?

A. To specify how the values in a list are delimited.

B. To compute numerical statistics on each field.

C. To group the results by one or more fields.

D. To partition the input data based on the split-by fields.

正確答案: C

問題13

Which search will return only events containing the word "error" and display the results as a table that includes the fields named action, src, and dest?

A. error | tabular action, src, dest

B. error | table column=action column=src column=dest

C. error | table action, src, dest

D. error | stats table action, src, dest

正確答案: D

說明：（僅 Fast2test 成員可見）

問題14

It is no possible for a single instance of Splunk to manage the input, parsing and indexing of machine data.

A. False

B. True

正確答案: A

最新的Splunk Core Certified User - SPLK-1001免費考試真題

聯系我們

站內鏈接

最新更新