Font size
S
M
L
XL
WorksheetsSplunk Quiz 2
Total questions: 60
Worksheet time: 3600secs
Name
Class
Date
1.
Which of the following is a best practice when writing a search string?
a)
Include all formatting commands before any search terms.
b)
Include at least one function as this is a search requirement.
c)
Include the search terms at the beginning of the search string.
d)
Avoid using formatting clauses, as they add too much overhead.
2.
What type of search can be saved as a report?
a)
Any search can be saved as a report.
b)
Only searches that generate visualizations.
c)
Only searches containing a transforming command.
d)
Only searches that generate statistics or visualizations.
3.
What can be included in the All Fields option in the sidebar?
a)
Dashboards
b)
Metadata only
c)
Non-interesting fields
d)
Field descriptions
4.
When viewing the results of a search, what is an Interesting Field?
a)
A field that appears in any event.
b)
A field that appears in every event.
c)
A field that appears in the top 10 events.
d)
A field that appears in at least 20% of the events.
5.
When a Splunk search generates calculated data that appears in the Statistics tab, in what formats can the results be exported?
a)
CSV, JSON, PDF
b)
CSV, XML, JSON
c)
Raw Events, XML, JSON
d)
Raw Events, CSV, XML, JSON
6.
Which search matches the events containing the terms `error` and `fail`?
a)
index=security Error Fail
b)
index=security error OR fail
c)
index=security ‘error failure’
d)
index=security NOT error NOT fail
7.
Which of the following is an option after clicking an item in search results?
a)
Saving the item to a report.
b)
Adding the item to the search.
c)
Adding the item to a dashboard.
d)
Saving the Search to a JSON file.
8.
Which of the following fields is stored with the events in the index?
a)
user
b)
source
c)
location
d)
sourceIp
9.
Which of the following is the recommended way to create multiple dashboards displaying data from the same search?
a)
Save the search as a report and use it in multiple dashboards as needed.
b)
Save the search as a dashboard panel for each dashboard that needs the data.
c)
Save the search as a scheduled alert and use it in multiple dashboards as needed.
d)
Export the results of the search to an XML file and use the file as the basis of the dashboards.
10.
What does the following specified time range do? earliest=-72h@h latest=@d
a)
Look back 3 days ago and prior.
b)
Look back 72 hours, up to one day ago.
c)
Look back 72 hours, up to the end of today.
d)
Look back from 3 days ago, up to the beginning of today.
11.
Which events will be returned by the following search string? host=www3 status=503
a)
All events that either have a host of www3 or a status of 503.
b)
All events with a host of www3 that also have a status of 503.
c)
We need more information; we cannot tell without knowing the time range.
d)
We need more information; a search cannot be run without specifying an index.
12.
What does the stats command do?
a)
Automatically correlates related fields.
b)
Converts field values into numerical values.
c)
Calculates statistics on data that matches the search criteria.
d)
Analyzes numerical fields for their ability to predict another discrete field.
13.
Which is primary function of the timeline located under the search bar?
a)
To differentiate between structured and unstructured events in the data.
b)
To sort the events returned by the search command in chronological order.
c)
To zoom in and zoom out, although this does not change the scale of the chart.
d)
To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime.
14.
What can be configured using the Edit Job Settings menu?
a)
Export the result to CSV format.
b)
Add the Job results to a dashboard.
c)
Schedule the Job to re-run in 10 minutes.
d)
Change Job Lifetime from 10 minutes to 7 days.
15.
Which command is used to validate a lookup file?
a)
| lookup products.csv
b)
inputlookup products.csv
c)
| inputlookup products.csv
d)
| lookup_definition products.csv
16.
Which statement is true about the top command?
a)
It returns the top 10 results.
b)
It displays the output in table format.
c)
It returns the count and percent columns per row.
d)
All of the above.
17.
How can another user gain access to a saved report?
a)
The owner of the report can edit permissions from the Edit dropdown.
b)
Only users with an Admin or Power User role can access other users' reports.
c)
Anyone can access any reports marked as public within a shared Splunk deployment.
d)
The owner of the report must clone the original report and save it to their user account.
18.
What is the primary use for the rare command?
a)
To sort field values in descending order.
b)
To return only fields containing five of fewer values.
c)
To find the least common values of a field in a dataset.
d)
To find the fields with the fewest number of values across a dataset.
19.
What happens when a field is added to the Selected Fields list in the fields sidebar?
a)
Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field.
b)
Splunk will highlight related fields as a suggestion to add them to the Selected Fields list.
c)
Custom selections will replace the Interesting Fields that Splunk populated into the list at search time.
d)
The selected field and its corresponding values will appear underneath the events in the search results.
20.
By default, which of the following is a Selected Field?
a)
action
b)
clientip
c)
categoryId
d)
sourcetype
21.
According to Splunk best practices, which placement of the wildcard results in the most efficient search?
a)
f*il
b)
*fail
c)
fail*
d)
*fail*
22.
Which command automatically returns percent and count columns when executing searches?
a)
top
b)
stats
c)
table
d)
percent
23.
Which of the following describes lookup files?
a)
Lookup fields cannot be used in searches.
b)
Lookups contain static data available in the index.
c)
Lookups add more fields to results returned by a search.
d)
Lookups pull data at index time and add them to search results.
24.
Which search string is the most efficient?
a)
“failed password”
b)
“failed password”*
c)
index=* “failed password”
d)
index=security “failed password”
25.
Which search string matches only events with the status_code of 404?
a)
status_code!=404
b)
status_code>=400
c)
status_code<=404
d)
status_code>403 status_code<405
26.
_______________ transforms raw data into events and distributes the results into an index.
a)
Index
b)
Search Head
c)
Indexer
d)
Forwarder
27.
Documentations for Splunk can be found at docs.splunk.com
a)
True
b)
False
28.
Which component of Splunk is primarily responsible for saving data?
a)
Search Head
b)
Heavy Forwarder
c)
Indexer
d)
Universal Forwarder
29.
Universal forwarder is recommended for forwarding the logs to indexers.
a)
False
b)
True
30.
Splunk apps are used for following (Choose three.):
a)
Designed to cater numerous use cases and empower Splunk.
b)
We can not install Splunk App.
c)
Allows multiple workspaces for different use cases/user roles.
d)
It is collection of different Splunk config files like data inputs, UI and Knowledge Object.
31.
What is Splunk?
a)
Splunk is a software platform to search, analyze and visualize the machine-generated data.
b)
Database management tool.
c)
Security Information and Event Management (SIEM).
d)
Cloud based application that help in analyzing logs.
32.
We should use heavy forwarder for sending event-based data to Indexers.
a)
False
b)
True
33.
Splunk Enterprise is used as a Scalable service in Splunk Cloud.
a)
True
b)
False
34.
Which component of Splunk let us write SPL query to find the required data?
a)
Forwarders
b)
Indexer
c)
Heavy Forwarders
d)
Search head
35.
All components are installed and administered in Splunk Enterprise on-premise.
a)
True
b)
False
36.
Log filtering/parsing can be done from _____________.
a)
Index Forwarders (IF)
b)
Universal Forwarders (UF)
c)
Super Forwarder (SF)
d)
Heavy Forwarders (HF)
37.
Which is the default app for Splunk Enterprise?
a)
Splunk Enterprise Security Suite
b)
Search and Reporting
c)
Reporting and Searching
d)
Splunk apps for Security
e)
Database logs
38.
Portal for Splunk apps can be accessed through www.splunkbase.com
a)
False
b)
True
39.
Splunk shows data in __________________.
a)
ASCII Character order.
b)
Reverse chronological order.
c)
Alphanumeric order.
d)
Chronological order.
40.
Which of the following can be used as wildcard search in Splunk?
a)
=
b)
>
c)
!
d)
*
41.
What result will you get with following search index=test sourcetype="The_Questionnaire_P*" ?
a)
the_questionnaire _pedia
b)
the_questionnaire pedia
c)
the_questionnaire_pedia
d)
the_questionnaire Pedia
42.
Prefix wildcards might cause performance issues.
a)
False
b)
True
43.
Machine data can be in structured and unstructured format.
a)
False
b)
True
44.
Field names are case sensitive.
a)
True
b)
False
45.
Splunk internal fields contains general information about events and starts from underscore i.e. _ .
a)
True
b)
False
46.
How many main user roles do you have in Splunk?
a)
2
b)
4
c)
1
d)
3
47.
Which of the following are Splunk premium enhanced solutions? (Choose three.)
a)
Splunk User Behavior Analytics (UBA)
b)
Splunk IT Service Intelligence (ITSI)
c)
Splunk Enterprise Security (ES)
d)
Splunk Analytics Security (AS)
48.
Fields are searchable name and value pairings that differentiates one event from another.
a)
False
b)
True
49.
Splunk extracts fields from event data at index time and at search time.
a)
True
b)
False
50.
Field values are case sensitive.
a)
True
b)
False
51.
Splunk indexes the data on the basis of timestamps.
a)
True
b)
False
52.
______________ is the default web port used by Splunk.
a)
8089
b)
8000
c)
8080
d)
443
53.
Which of the following statements are correct about Search & Reporting App? (Choose three.)
a)
Can be accessed by Apps > Search & Reporting.
b)
Provides default interface for searching and analyzing logs.
c)
Enables the user to create knowledge object, reports, alerts and dashboards.
d)
It only gives us search functionality.
54.
Parsing of data can happen both in HF and Indexer.
a)
Only HF
b)
No
c)
Yes
55.
Monitor option in Add Data provides _______________.
a)
Only continuous monitoring.
b)
Only One-time monitoring.
c)
None of the above.
d)
Both One-time and continuous monitoring.
56.
License Meter runs before data compression.
a)
No
b)
Yes
57.
Forward Option gather and forward data to indexers over a receiving port from remote machines.
a)
False
b)
True
58.
Data sources being opened and read applies to:
a)
None of the above
b)
Indexing Phase
c)
Parsing Phase
d)
Input Phase
e)
License Metering
59.
Select the correct option that applies to Index time processing (Choose three.).
a)
Indexing
b)
Searching
c)
Parsing
d)
Settings
e)
Input
60.
Splunk automatically determines the source type for major data types.
a)
False
b)
True
Reset
