Splunk Quiz 2

Which of the following is a best practice when writing a search string?

• Include all formatting commands before any search terms.
• Include at least one function as this is a search requirement.
• Include the search terms at the beginning of the search string.
• Avoid using formatting clauses, as they add too much overhead.

What type of search can be saved as a report?

• Any search can be saved as a report.
• Only searches that generate visualizations.
• Only searches containing a transforming command.
• Only searches that generate statistics or visualizations.

What can be included in the All Fields option in the sidebar?

• Dashboards
• Metadata only
• Non-interesting fields
• Field descriptions

When viewing the results of a search, what is an Interesting Field?

• A field that appears in any event.
• A field that appears in every event.
• A field that appears in the top 10 events.
• A field that appears in at least 20% of the events.

When a Splunk search generates calculated data that appears in the Statistics tab, in what formats can the results be exported?

• CSV, JSON, PDF
• CSV, XML, JSON
• Raw Events, XML, JSON
• Raw Events, CSV, XML, JSON

Which search matches the events containing the terms `error` and `fail`?

• index=security Error Fail
• index=security error OR fail
• index=security ‘error failure’
• index=security NOT error NOT fail

Which of the following is an option after clicking an item in search results?

• Saving the item to a report.
• Adding the item to the search.
• Adding the item to a dashboard.
• Saving the Search to a JSON file.

Which of the following fields is stored with the events in the index?

• user
• source
• location
• sourceIp

Which of the following is the recommended way to create multiple dashboards displaying data from the same search?

• Save the search as a report and use it in multiple dashboards as needed.
• Save the search as a dashboard panel for each dashboard that needs the data.
• Save the search as a scheduled alert and use it in multiple dashboards as needed.
• Export the results of the search to an XML file and use the file as the basis of the dashboards.

What does the following specified time range do? earliest=-72h@h latest=@d

• Look back 3 days ago and prior.
• Look back 72 hours, up to one day ago.
• Look back 72 hours, up to the end of today.
• Look back from 3 days ago, up to the beginning of today.