New Year Special Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: scxmas70

SPLK-1001 Exam Dumps - Splunk Core Certified User

Go to page:
Question # 4

When using the top command in the following search, which of the following will be true about the results?

index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count

A.

The search will fail. The proper top command format is top limit=3 instead of top 3.

B.

The top three most common values in statusCode will be displayed for each user.

C.

Only the top three overall most common values in statusCode will be displayed.

D.

The percentage field will be displayed in the results.

Full Access
Question # 5

Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

A.

(index=netfw failure) AND index=netops warn OR critical

B.

(index=netfw failure) OR (index=netops (warn OR critical))

C.

(index=netfw failure) AND (index=netops (warn OR critical))

D.

(index=netfw failure) OR index=netops OR (warn OR critical)

Full Access
Question # 6

Keywords are highlighted when you mouse over search results and you can click this search result to (Choose three.):

A.

Open new search.

B.

Exclude the item from search.

C.

None of the above.

D.

Add the item to search

Full Access
Question # 7

Which Boolean operator is implied between search terms, unless otherwise specified?

A.

OR

B.

AND

C.

NOT

D.

NAND

Full Access
Question # 8

How do you add or remove fields from search results?

A.

Use field +to add and field -to remove.

B.

Use table +to add and table -to remove.

C.

Use fields +to add and fields –to remove.

D.

Use fields Plus to add and fields Minus to remove.

Full Access
Go to page: