Dumpsbuddy logo
When using the top command in the following search, which of the following will be true about the results?
index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count
Assuming a user has the capability to edit reports, which of the following are editable?
In automatic lookup definitions, the _____ fields are those that are not in the event data.
Which of the following searches will return results where fail, 400, and error exist in every event?
Which Field/Value pair will return only events found in the index named security?
Data summary button just below the search bar gives you the following (Choose three.):
When placed early in a search, which command is most effective at reducing search execution time?
What is the result of the following search?
index=myindex source=c: \mydata. txt NOT error=*
When looking at a dashboard panel that is based on a report, which of the following is true?
Which search will return only events containing the word “error” and display the results as a table that includes
the fields named action, src, and dest?
At the time of searching the start time is 03:35:08.
Will it look back to 03:00:00 if we use -30m@h in searching?
In the Fields sidebar, what does the number directly to the right of the field name indicate?
Splunk internal fields contains general information about events and starts from underscore i.e. _ .
According to Splunk best practices, which placement of the wildcard results in the most efficient search?
When writing searches in Splunk, which of the following is true about Booleans?
Beginning parentheses is automatically highlighted to guide you on the presence of complimenting
parentheses.
What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?
You can also specify a time range in the search bar. You can use the following for beginning and ending for a
time range (Choose two.):
Which stats command function provides a count of how many unique values exist for a given field in the result set?
When editing a dashboard, which of the following are possible options? (select all that apply)
Select the answer that displays the accurate placing of the pipe in the following search string:
index=security sourcetype=access_* status=200 stats count by price
Select the correct option that applies to Index time processing (Choose three.).
Which of the following file types is an option for exporting Splunk search results?
Which Boolean operator is always implied between two search terms, unless otherwise specified?
Which search string returns a filed containing the number of matching events and names that field Event Count?
It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine.
What is the proper SPL terminology for specifying a particular index in a search?
Fields are searchable name and value pairings that differentiates one event from another.
Which all time unit abbreviations can you include in Advanced time range picker? (Choose seven.)
Search Assistant is enabled by default in the SPL editor with compact settings.
The four types of Lookups that Splunk provides out-of-the-box are External, KV Store, Geospatial and which of the following?
Which of the following is the recommended way to create multiple dashboards displaying data from the same search?
After running a search, what effect does clicking and dragging across the timeline have?
When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?
TESTED 30 Apr 2024
