Intro to Splunk

By default, how long does a search job remain active?

• 7 days

• 30 mins

• 10 mins

• 1 hr

Which of the following searches will return results containing the phrase "failed password"?

• failed password

• "failed password"

• (failed password)

• 'failed password'

Which of the following searches will return results containing the words fail, failure, or failed?

• fail

• fail+

• fail*

• *fail

By default, which of the following roles are required to share knowledge objects?

• Admin

• Manager

• Power

• User

Which Splunk infrastructure component stores ingested data?

• Index

• Dashboards

• Data models

• Datasets

Which character is used in a search before a command?

• A quotation mark ( " )

• A tilde (~)

• A pipe ( | )

• A backtick ( ` )

Which search mode behaves differently depending on the type of search being run?

• Variable

• Fast

• Smart

• Verbose

Which command can be used to further filter results in a search?

• search

• filter

• subset

• subsearch

What determines the timestamp shown on returned events in a search?

• The time zone where the event originated

• Timestamps are displayed in Greenwich Mean Time

• Timestamps are displayed in epoch time

• The time zone defined in user settings

What is the most efficient way to limit search results returned?

• index

• host

• time

• source