Splunk Part 2

Splunk shows data in ____ .

• ASCII Character order.

• Reverse chronological order.

• Alphanumeric order.

• Chronological order.

When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

• Cloned panel

• Inline panel

• Report panel

• Prebuilt panel

Which statement is true about Splunk alerts?

• Alerts are based on searches that are either run on a scheduled interval or in real-time.

• Alerts are based on searches and when triggered will only send an email notification.

• Alerts are based on searches and require cron to run on scheduled interval.

• Alerts are based on searches that are run exclusively as real-time.

What is one benefit of creating dashboard panels from reports?

• Any newly created dashboard will include that report.

• There are no benefits to creating dashboard panels from reports.

• It makes the dashboard more efficient because it only has to run one search string.

• Any change to the underlying report will affect every dashboard that utilizes that report.

Which time range picker configuration would return real-time events for the past 30 seconds?

• Preset - Relative: 30-seconds ago

• Relative - Earliest: 30-seconds ago, Latest: Now

• Real-time - Earliest: 30-seconds ago, Latest: Now

• Advanced - Earliest: 30-seconds ago, Latest: Now

What determines the scope of data that appears in a scheduled report?

• All data accessible to the User role will appear in the report.

• All data accessible to the owner of the report will appear in the report.

• All data accessible to all users will appear in the report until the next time the report is run.

• The owner of the report can configure permissions so that the report uses either the User role or the owner’s profile at run time.

What user interface component allows for time selection?

• Time summary

• Time range picker

• Search time picker

• Data source time statistics

What does the values function of the stats command do?

• Lists all values of a given field.

• Lists unique values of a given field.

• Returns a count of unique values for a given field.

• Returns the number of events that match the search.

status_code>=400 status_code<=404 status code>403 status_code<405

• status_code>=400

• status_code<=404

• status code>403 status_code<405

In the Splunk interface, the list of alerts can be filtered based on which characteristics?

• App, Owner, Severity, and Type

• App, Owner, Priority, and Status

• App, Dashboard, Severity, and Type

• App, Time Window, Type, and Severity (correct)