Question 1

What does the stats command do?

Options :

A : Automatically correlates related fields

B : Converts field values into numerical values

C : Calculates statistics on data that matches the search criteria

D : Analyzes numerical fields for their ability to predict another discrete field

Answer: C

Question 2

Which search would return events from the access_combined sourcetype?

Options :

A : Sourcetype=access_combined

B : Sourcetype=Access_Combined

C : sourcetype=Access_Combined

Answer: C

Question 3

What is the primary use for the rare command1?

Options :

A : To sort field values in descending order

B : To return only fields containing five or fewer values

C : To find the least common values of a field in a dataset

D : To find the fields with the fewest number of values across a dataset

Answer: C

Question 4

Select the best options for "search best practices" in Splunk:

(Choose five.)

Options :

A : Select the time range always

B : Try to specify index values.

C : Include as many search terms as possible.

D : Never select time range.

E : Try to use * with every search term

F : Inclusion is generally better than exclusion

G : Try to keep specific search terms.

Answer: A,B,C

Question 5

How can search results be kept longer than 7 days?

Options :

A : By scheduling a report.

B : By creating a link to the job.

C : By changing the job settings.

D : By changing the time range picker to more than 7 days

Answer: A

Higher Test Marks with Free Online SPLK-1001 Exam Practice