SPLK-1001 Free Practice Test

What happens when a field is added to the Selected Fields list in the fields sidebar?

1. A. Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field.
2. B. Splunk will highlight related fields as a suggestion to add them to the Selected Fields list.
3. C. Custom selections will replace the Interesting Fields that Splunk populated into the list at search time.
4. D. The selected field and its corresponding values will appear underneath the events in the search results.

Correct Answer: D

How does Splunk determine which fields to extract from data?

1. A. Splunk only extracts the most interesting data from the last 24 hours.
2. B. Splunk only extracts fields users have manually specified in their data.
3. C. Splunk automatically extracts any fields that generate interesting visualizations.
4. D. Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data.

Correct Answer: D

You are able to create new Index in Data Input settings.

1. A. No
2. B. Yes

Correct Answer: B

Forward Option gather and forward data to indexers over a receiving port from remote machines.

1. A. False
2. B. True

Correct Answer: B

Which is primary function of the timeline located under the search bar?

1. A. To differentiate between structured and unstructured events in the data.
2. B. To sort the events returned by the search command in chronological order.
3. C. To zoom in and zoom out, although this does not change the scale of the chart.
4. D. To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime.

Correct Answer: D