SPLK-1004 Practice Test 3 — 10 Questions

Question 1

What is the result of applying multiple aliases to the same field?

Accepted Answer

The field will have multiple valid names in the search.. Splunk allows multiple aliases for the same field; all will result in the field being populated with the value.

Answer

The original field name is deleted.

Answer

The search will fail due to a conflict.

Answer

Only the first alias takes effect.

Question 2

You are configuring a field lookup that needs to execute automatically for every search on a specific sourcetype. Where is the most appropriate place to configure this?

Accepted Answer

props.conf. Automatic lookups are defined in props.conf or via the 'Automatic lookups' menu in Manager, mapping the lookup table to a specific sourcetype.

Answer

indexes.conf

Answer

lookups.conf

Answer

transforms.conf

Answer

savedsearches.conf

Question 3

Where can you define an event type?

Accepted Answer

In the Settings > Event types menu.. Event types can be created via the Settings > Event types menu or by editing eventtypes.conf.

Answer

In the indexer's inputs.conf file.

Answer

In the user's .bashrc file.

Answer

Directly in the search head's license file.

Question 4

How can you view all existing field aliases in the Splunk Web interface?

Accepted Answer

Settings > Fields > Field aliases.. Settings > Fields > Field aliases is the path to manage all aliases.

Answer

Settings > Data inputs.

Answer

Settings > Lookups.

Answer

Settings > Indexes.

Question 5

You need to combine two fields into one string. Which eval function is used?

Accepted Answer

eval new = field1 . field2. The '.' operator or the 'concat' function (in some contexts) or simply concatenating works.

Answer

eval new = field1 + field2

Answer

eval new = merge(field1, field2)

Answer

eval new = combine(field1, field2)

Question 6

You need to count the total number of unique users per department using the 'stats' command. Which command syntax is correct?

Accepted Answer

stats dc(user) by department. The 'dc' function (distinct count) is used to count unique values in a field.

Answer

stats list(user) by department

Answer

stats values(user) by department

Answer

stats count(user) by department

Question 7

Which command sorts results by a field in descending order?

Accepted Answer

sort -field. The 'sort -field' syntax sorts in reverse (descending) order.

Answer

sort desc(field)

Answer

sort field=desc

Answer

sort field

Question 8

If you need a macro to perform a search that uses a pipe ('|'), how should it be defined?

Accepted Answer

Include the pipe as the first character in the macro definition. The macro definition should start with the pipe if it is intended to append to an existing search, or be a standalone query.

Answer

Use the \| escape character

Answer

Exclude the pipe; Splunk adds it automatically

Answer

Pipes cannot be used in macros

Question 9

How do you handle case-insensitive filtering in a 'where' clause?

Accepted Answer

where lower(field) = "value". The 'lower()' function is used to normalize the string for comparison.

Answer

where field == /value/i

Answer

where field = '(?i)value'

Answer

where field.case = "ignore"

Question 10

Which THREE of the following functions are used with 'stats' to aggregate data?

Accepted Answer

max. Sum, count, and max are all valid stats functions.

Answer

eval

Answer

search