SPLK-1001 Practice Test

SPLK-1001 Practice Test practice questions, page 5 of 9, with answer review and explanations.

Question 21

After running a search, what effect does clicking and dragging across the timeline have?

  1. Executes a new search.
  2. Filters current search results.
  3. Moves to past or future events.
  4. Expands the time range of the search.

Question 22

Which command is used to review the contents of a specified static lookup file?

  1. lookup
  2. csvlookup
  3. inputlookup
  4. outputlookup

Question 23

What must be done in order to use a lookup table in Splunk?

  1. The lookup must be configured to run automatically.
  2. The contents of the lookup file must be copied and pasted into the search bar.
  3. The lookup file must be uploaded to Splunk and a lookup definition must be created.
  4. The lookup file must be uploaded to the etc/apps/lookups folder for automatic ingestion.

Question 24

When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

  1. |
  2. $
  3. !
  4. ,

Question 25

Which time range picker configuration would return real-time events for the past 30 seconds?

  1. Preset - Relative: 30-seconds ago
  2. Relative - Earliest: 30-seconds ago, Latest: Now
  3. Real-time - Earliest: 30-seconds ago, Latest: Now
  4. Advanced - Earliest: 30-seconds ago, Latest: Now