Splunk Core User

When linking key/value pairs in search strings, what syntax is used?

• status-200

• status | 200

• status=200

• status equals 200

Out of the following queries, which search string returns a field where the number of matching events is stored, and then stored as Purchases?

• index=access_combined_wcookie status=200 file="success.do" | stats sum as "Purchases"

• index=access_combined_wcookie status=200 file="success.do" | stats count as "Purchases"

• index=access_combined_wcookie status=200 file="success.do" | stats count by "Purchases"

• index=access_combined_wcookie status=200 file="success.do" | stats dc(count) as "Purchases"

Which of the following search strings only returns events from the source access_30day.log?

• source=*

• source=access_30day.log

• source=access_30day.*

• Source=access_30day.log

What is the default retention period of a search job in Splunk by default?

• 10 Minutes

• 15 Minutes

• 24 Hours

• 7 Days

In a typical Splunk deployment, which of the following components is found on the machine that originates the data?

• Indexer

• Forwarder

• Search head

• Deployment server

When a scheduled report is run, what is the scope of the data that will be included in the report?

• The report will contain all the data that the User role has access to.

• Reports display all information accessible to the owner.

• Until the report is run again, all data that is accessible to all users will be included in the report.

• Owners have the option of configuring permissions so that a report is run using either the User role or the owner's profile.

The Boolean operator is just one of many search term components in Splunk. Which of the following is true about the boolean operator?

• A boolean must be written in lowercase.

• A boolean must be written in uppercase.

• There must be quotation marks around booleans.

• Parentheses are required around booleans.

What search would return error events in index db_audit or failed or failing events in index linux_secure?

• (index=db_audit error) AND index=linux_secure failed OR failing

• (index=db_audit error) OR (index=linux_secure (failed OR failing))

• (index=db_audit error) AND (index=linux_secure (failed OR failing))

• (index=db_audit error) OR index=linux_secure OR (failed OR failing)

Based on the following search string, choose the answer that displays the correct pipe placement:
index=main sourcetype=access_combined_wcookie status=403 stats count as Transactions

• index=main sourcetype=access_combined_wcookie status=403 stats | count as Transactions

• index=main sourcetype=access_combined_wcookie status=403 | stats count as Transactions

• index=main sourcetype=access_combined_wcookie status=403 | stats count | as Transactions

• index=main sourcetype=access_combined_wcookie | status=403 | stats count as Transactions

When using the top command within your query, which of the following constraints can be applied?

• limit

• percshow

• limits

• fieldcount