SPLK-3001 Free Practice Test

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

1. A. A prefix of CIM_
2. B. A suffix of .spl
3. C. A prefix of TECH_
4. D. A prefix of Splunk_TA_

Correct Answer: D
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/planintegrationes/

Which of the following is a key feature of a glass table?

1. A. Rigidity.
2. B. Customization.
3. C. Interactive investigations.
4. D. Strong data for later retrieval.

Correct Answer: B

Where is the Add-On Builder available from?

1. A. GitHub
2. B. SplunkBase
3. C. www.splunk.com
4. D. The ES installation package

Correct Answer: B
Reference: https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Installation

Which of the following is a way to test for a property normalized data model?

1. A. Use Audit -> Normalization Audit and check the Errors panel.
2. B. Run a | datamodel search, compare results to the CIM documentation for the datamodel.
3. C. Run a | loadjob search, look at tag values and compare them to known tags based on the encoding.
4. D. Run a | datamodel search and compare the results to the list of data models in the ES normalization guide.

Correct Answer: B
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime