Step 1

Question 1

What are the 3 main roles out of the box with splunk

Answer 1

Admin, User, Power

Question 2

Can a power user create additional roles

Answer 2

No

Question 3

What app is used for the exam

Answer 3

Search and Reporting

Question 4

What does the hostname represent when

importing data

Answer 4

The Name of the server the data is coming from

Question 5

Data: What does the Upload Option do

Answer 5

Uploads local files that get indexed once

Question 6

Data: What does the monitor option do

Answer 6

Monitors Files, Directories, HTTP Events, or Data Gathering Scripts on Splunk instances

Question 7

Data: What does the forward option do

Answer 7

Data is gathered on a remote machine and forwarded to an index over a receiving port

Question 8

What are the 3 data summary tabs

Answer 8

Host, Sources and Source Types

Question 9

Search Results are displayed in reverse chronological order, True or False

Answer 9

TRUE

Question 10

Every Search is also a Job. True or False

Answer 10

True

Question 11

How long does a job last for after its created

Answer 11

10 Minutes

Question 12

whats the maximum a Job be extended to?

Answer 12

7 days

Question 13

Which menu gives you access to your jobs history?

Answer 13

Activity

Question 14

What are fields?

Answer 14

Serachable value/pairs in your event data i.e. host=www1, stats=404

Question 15

What is implied automatically between serach fields

Answer 15

AND

Question 16

Define Selected Fields and their defaults

Answer 16

Occur in every event, host, source, sourcetype

Question 17

Can a selected field by any field

Answer 17

YES

Question 18

___ is generally better than ____ when searching

Answer 18

Inclusion is generally better than exclusion when searching

Question 19

does the @ symbol round up or down

Answer 19

Rounds down to nearest time depending on delimiter i.e. hms

Question 20

Whats the purpose of an index for administrators

Answer 20

to segregrate data to limit access by splunk role

Question 21

Its possible to specify multiple indexes in one search. True or False

Answer 21

True, using the OR command i.e. (index=security OR index=weblogs)

Question 22

What does the ‘|’ do

Answer 22

Takes these events and…

Question 23

What are the 5 basic search components

Answer 23

Search Terms, Commands, Functions, Arguments and Clauses

Question 24

Table Function Only the fields in the argument list. True or False

Answer 24

True

Question 25

What command removes duplicates from your results

Answer 25

dedup