Font size
S
M
L
XL
WorksheetsSplunk Power User Quiz 4
Total questions: 65
Worksheet time: 1hrs 3mins
Name
Class
Date
1.
What determines the timestamp shown on returned events in a search?
a)
Timestamps are displayed in Greenwich Mean Time
b)
The time zone where the event originated
c)
Timestamps are displayed in epoch time
d)
The time zone defined in user settings
2.
Which of the following searches will return results containing the phrase "failed password"?
a)
"failed password"
b)
failed password
c)
(failed password)
d)
`failed password`
3.
By default, who is able to view a saved report?
a)
Any user with a power or admin role
b)
Any user with the viewreports capability
c)
The user who created it
d)
Any user with a power or admin role
4.
By default, which of the following roles are required to share knowledge objects? (Select all that apply)
a)
User
b)
Admin
c)
Manager
d)
Power
5.
Which of the following searches will return results containing the terms failed, password, or failed password? (Select all that apply)
a)
failed password OR "failed password"
b)
fail*
c)
failed OR password
d)
failed OR password OR "failed password"
6.
Which character is used in a search before a command?
a)
A tilde (~)
b)
A quotation mark (")
c)
A backtick (`)
d)
A pipe (|)
7.
When a search is run, in what order are events returned?
a)
Chronological order
b)
Reverse alphanumeric order
c)
Alphanumeric order
d)
Reverse chronological order
8.
By default, how long does a search job remain active?
a)
10 minutes
b)
7 days
c)
30 minutes
d)
-
9.
Which search mode behaves differently depending on the type of search being run?
a)
Smart
b)
Verbose
c)
Fast
d)
Variable
10.
What is the most efficient way to limit search results returned?
a)
time
b)
index
c)
source
d)
host
11.
Which Splunk infrastructure component stores ingested data?
a)
Data models
b)
Datasets
c)
Dashboards
d)
Index
12.
Which of the following booleans can be used in a search? (Select all that apply)
a)
OR
b)
NOT
c)
AND
d)
ALSO
13.
What are the default roles in Splunk Enterprise? (Select all that apply)
a)
User
b)
Power
c)
Manager
d)
Admin
14.
Which of the following searches will return results containing the words fail, failure, or failed?
a)
*fail
b)
fail+
c)
fail*
d)
fail
15.
At search time, if an event has an equal(=) sign, the data to the left is treated as a ______ and the data to the right is treated as a ______.
a)
field name, sourcetype
b)
lookup, value
c)
field name, value
d)
lookup, sourcetype
16.
To remove fields from a search, you would use the _________ command.
a)
fields-
b)
+fields
c)
fields+
d)
-fields
17.
At search time, _______ extracts fields from raw event data.
a)
field discovery
b)
fields command
c)
field extractor
d)
-
18.
Which of the following fields are default selected fields? (Select all that apply)
a)
host
b)
index
c)
source
d)
sourcetype
19.
In the Fields sidebar, Interesting Fields occur in at least ________ of resulting events.
a)
20%
b)
3%
c)
10%
d)
5%
20.
True or False: Once you rename a field, the new field name must be used in the rest of the search string.
a)
TRUE
b)
FALSE
c)
-
d)
-
21.
True or False: Fields are knowledge objects.
a)
FALSE
b)
TRUE
c)
-
d)
-
22.
The fields command allows you to do which of the following? Select all that apply.
a)
Include fields (fields +)
b)
Include fields (fields)
c)
Exclude fields (fields -)
d)
-
23.
Which of the following are default time fields? Select all that apply.
a)
date_mday
b)
date_day
c)
date_year
d)
date_hour
24.
Using earliest=-30d@d latest=@d is how to return results from 30 days ago up until the time the search was executed.
a)
TRUE
b)
FALSE
c)
-
d)
-
25.
When using the following search arguments, what will be returned? | timechart count span=1h
a)
chart of events in 1 hour chunks
b)
events with a duration of 1 hour
c)
events in the last 24 hours
d)
-
26.
@timeUnit will always round up and go forward through time.
a)
TRUE
b)
FALSE
c)
-
d)
-
27.
Choose the search that will sort events into one minute groups. Select all that apply.
a)
| bin _time span=1mins
b)
| bin span=1minutes
c)
| bin _time span=1m
d)
| bin span=1minute
28.
The _______ and _______ time modifiers will override the time range picker in a historical report.
a)
last
b)
first
c)
latest
d)
earliest
29.
date_time always reflects your local time zone and not the time/date from raw events.
a)
TRUE
b)
FALSE
c)
-
d)
-
30.
What will the strftime function return when using the %H argument with the _time field? Select all that apply.
a)
hour of the event generated at index time
b)
convert the hour into your local time based on your time zone setting of your Splunk web sessions
c)
time of raw event in UTC
d)
-
31.
True or False: Using an OVER and a BY clause with the chart command will create a multiseries data series.
a)
TRUE
b)
FALSE
c)
-
d)
-
32.
True or False: Use useother=false with the chart command if you want to hide the OTHER column.
a)
FALSE
b)
TRUE
c)
-
d)
-
33.
True or False: The pow(X,Y) eval function returns Y to the power of X.
a)
FALSE
b)
TRUE
c)
-
d)
-
34.
When using the top command, add the BY clause to ___.
a)
return results grouped by the field you specify in the BY clause
b)
specify how many results to return
c)
return a percentage of events
d)
specify which search mode to return results by
35.
By default, the sort command lists results in ___ order.
a)
descending
b)
ascending
c)
-
d)
-
36.
True or False: You can use wildcards (*) with the rename command to rename multiple fields that match a pattern.
a)
FALSE
b)
TRUE
c)
-
d)
-
37.
When you use the stats command with a BY clause, what is returned?
a)
an error message because you did not include a statistical function
b)
a statistical output for each value of the named field
c)
numerical statistics on each field if and only if all of the values of that field are numerical
d)
one row
38.
True or False: The timechart command will always have _time as the X-axis.
a)
TRUE
b)
FALSE
c)
-
d)
-
39.
Which of these eval functions takes no arguments?
a)
random
b)
min
c)
max
d)
pow
40.
When renaming fields with spaces or special characters, use the rename command and include the new field name in ___.
a)
double quotes
b)
parenthesis
c)
None of the above
d)
single quotes
41.
True or False: Only one field can be created when using the eval command.
a)
FALSE
b)
TRUE
c)
-
d)
-
42.
To display the least common values of a field, use the ___ command.
a)
top
b)
stats
c)
timechart with common=f option
d)
rare
43.
Which of these functions lists ALL values of the field X?
a)
values(X)
b)
list(X)
c)
-
d)
-
44.
Which eval function would you use to round numerical values?
a)
commas
b)
roundvalue
c)
round
d)
tonumber
45.
If you use the stats command with two functions and a BY clause, which function is the BY clause applied to?
a)
the first function
b)
both functions if they are both aggregate functions
c)
the second function
d)
both functions
46.
The ____(X,Y) eval function returns X to the power of Y.
a)
pow
b)
round
c)
max
d)
-
47.
Use ____=false with the chart command if you want to hide the OTHER column.
a)
pow
b)
useother
c)
other
d)
-
48.
Which of the following methods can be used to manually extract fields? Select all that apply.
a)
Regular Expressions, or RegEx
b)
The Regular Expression Generator
c)
The Event Type Builder
d)
Delimiters
49.
What are the primary functions of a workflow action? Select all that apply
a)
Passing information to external deployments to query additional indexes
b)
Communicating with an external source using the HTTP GET method
c)
Passing information back to Splunk to run a secondary search
d)
Communicating with an external source using the HTTP POST method
50.
Which knowledge object type can communicate with external sources using the HTTP GET and POST methods?
a)
Lookups
b)
Search actions
c)
Field extractions
d)
Workflow actions
51.
By default, when a knowledge object is created, who can access its contents?
a)
The user who created it or a user with an admin role
b)
Any power user in the environment
c)
Any user in the environment
d)
Any user of the app in which it was created
52.
Which knowledge objects can be scheduled to execute at specific times? (Select all that apply)
a)
Workflow actions
b)
Macros
c)
Alerts
d)
Reports
53.
Which of the following file types can be uploaded to create a lookup?
a)
XLS
b)
PDF
c)
CSV
d)
XML
54.
Which knowledge object type can be searched in Pivot?
a)
Event types
b)
Data models
c)
Dashboards
d)
Data types
55.
Where can you find a list of all fields returned from events?
a)
The fields library
b)
The fields sidebar
c)
The fields posting list
d)
The fields dropdown
56.
When a user has left your organization, what happens to their knowledge objects?
a)
They are automatically reassigned to an admin.
b)
They are automatically reassigned to a power user.
c)
A power user can reassign them to another user.
d)
An admin can reassign them to another user.
57.
By default, what user role is required to make a knowledge object available to all apps?
a)
Admin
b)
Super User
c)
User
d)
Power User
58.
Which knowledge object type can store entire search strings, including commands?
a)
Tags
b)
Macros
c)
Event types
d)
Calculated fields
59.
Which knowledge object type can contain an eval expression?
a)
Tags
b)
Calculated fields
c)
Field aliases
d)
Event types
60.
What are the three predefined sharing options for a knowledge object? (Seòect all that apply)
a)
Blocked in app
b)
Private
c)
Shared in all apps
d)
Shared in app
61.
Which of the following user roles can create knowledge objects? Select all that apply
a)
Super User
b)
Admin
c)
User
d)
Power User
62.
Which two of the following knowledge object types can contain an eval expression? Select all that apply.
a)
Field aliases
b)
Calculated fields
c)
Macros
d)
Workflow actions
63.
Which alert setting allows you to control how many alert actions are taken when trigger conditions are met?
a)
Schedule Window
b)
Limit
c)
Schedule Priority
d)
Throttle
64.
Select the two valid types of alerts.
a)
Email
b)
Real-time
c)
Text message (SMS)
d)
Scheduled
65.
Which scheduled alert type will continuously run in the background?
a)
Constant
b)
Real-time
c)
Automatic
d)
Interval
Reset
