SPLK-2001 Free Practice Test

Which of the following statements define a namespace?

1. A. The namespace is a combination of the user and the app.
2. B. The namespace is a combination of the user, the app, and the role.
3. C. The namespace is a combination of the user, the app, the role, and the sharing level.
4. D. The namespace is a combination of the user, the app, the role, the sharing level, and the permissions.

Correct Answer: A

Data can be added to a KV store collection in which of the following format(s)?

1. A. JSON
2. B. JSON, XML
3. C. JSON, XML, CSV
4. D. JSON, XML, CSV, TXT

Correct Answer: A

Which of the following are valid parent elements for the event action shown below? (Select all that apply.)
sourcetype=$click.value|s$>

1. A. <eval>
2. B.
3. C.
4. D.

Correct Answer: AC

A KV store collection can be associated with a namespace for which of the following users?

1. A. Nobody
2. B. Users in the admin role.
3. C. Users in the admin and power roles.
4. D. Users in the admin, power, and splunk-system-user roles.

Correct Answer: B

There is a global search named ??global_search?? defined on a form as shown below:

1. A. | tstats count
2. B. sourcetype=mysourcetype
3. C. stats sum(count) AS count by log level
4. D. search log_level=error | stats sum(count) AS count by component

Correct Answer: CD