SPLK-2001 Free Practice Test

When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

1. A. Use a generating search.
2. B. Remove unneeded fields.
3. C. Truncate the data, using selective functions.
4. D. Summarize data, using analytic commands.

Correct Answer: AB

Assuming permissions are set appropriately, which REST endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role?

1. A. /servicesNS/-/data/saved/searches/mySearch
2. B. /servicesNS/object/saved/searches/mySearch
3. C. /servicesNS/search/saved/searches/mySearch
4. D. /servicesNS/-/search/saved/searches/mySearch

Correct Answer: D

Which HTTP Event Collector (HEC) endpoint should be used to collect data in the following format?
{??message??:??Hello World??, ??foo??:??bar??, ??pony??:??buttercup??}

1. A. data/inputs/http/{name}
2. B. services/collector/raw
3. C. services/collector
4. D. data/inputs/http

Correct Answer: B

Which of the following are ways to get a list of search jobs? (Select all that apply.)

1. A. Access Activity > Jobs with Splunk Web.
2. B. Use Splunk REST to query the /services/search/jobs endpoint.
3. C. Use Splunk REST to query the /services/saved/searches endpoint.
4. D. Use Splunk REST to query the /services/search/sid/results endpoint.

Correct Answer: AB

Which items below are configured in inputs.conf? (Select all that apply.)

1. A. A modular input written in Python.
2. B. A file input monitoring a JSON file.
3. C. A custom search command written in Python.
4. D. An HTTP Event Collector as receiver of data from an app.

Correct Answer: AD