Pass the Splunk Core Certified User SPLK-1001 Questions and answers with ExamsMirror

Yes

No

True

False

Alerts are based on searches that are either run on a scheduled interval or in real-time.

Alerts are based on searches and when triggered will only send an email notification.

Alerts are based on searches and require cron to run on scheduled interval.

Alerts are based on searches that are run exclusively as real-time.

All search jobs are saved for 10 days

All search jobs are saved for 10 hours

All search jobs are saved for 10 weeks

All search jobs are saved for 10 minutes

Time summary

Time range picker

Search time picker

Data source time statistics

To group the results by one or more fields.

To compute numerical statistics on each field.

To specify how the values in a list are delimited.

To partition the input data based on the split-by fields.

Reports are best named using many numbers so they can be more easily sorted.

Use a consistent naming convention so they are easily separated by characteristics such as group and object.

Name reports as uniquely as possible with no overlap to differentiate them from one another.

Any naming convention is fine as long as you keep an external spreadsheet to keep track.

Before clauses. For example: stats sum(bytes) | by host

Before commands. For example: | stats sum(bytes) by host

Before arguments. For example: stats sum| (bytes) by host

Before functions. For example: stats |sum(bytes) by host

Acceleration, schedule, permissions

The report’s name, schedule, permissions

The report’s name, acceleration, schedule

The report’s name, acceleration, permissions

Real-time

10 Minutes

Overnight Download

30 Minutes