SPLK-2001 Practice Exam Questions and Answers

A.  

Using Splunk logs.

B.  

Using the search job inspector.

C.  

Using the Monitoring Console.

D.  

Using the storage/collections/config REST endpoint.

A.  

$my_token$

B.  

C.  

false

D.  

disabled

A.  

Multiple tokens can be created for use with different sourcetypes and indexes.

B.  

The edit token http admin role capability is required to create a token.

C.  

To create a token, send a POST request to services/collector endpoint.

D.  

Tokens can be edited using the data/inputs/http/{tokenName} endpoint.

A.  

$APP_HOME/default/app.conf

B.  

$APP_HOME/local/default.meta

C.  

$APP_HOME/metadata/local.meta

D.  

$SPLUNK_HOME/etc/system/local/server.conf

A.  

‘http://localhost:8089/servicesNS/nobody/search/storage/collections/data/ employees?query={$and:[{rating:{$gte:2}},{rating:{$lt:5}}]} &output_mode-json’

B.  

‘http://localhost:8089/servicesNS/nobody/search/storage/collections/data/ employees?query={$and:[{rating:$gte:2}},{rating:{$lt:5}}]} &output_mode=json’

C.  

‘http://localhost:8089/servicesNS/nobody/search/storage/collections/data/ employees?query={%22rating%22:{%22$gte%22:2}},{%22$and%22},{%22rating%22:{% 22$lt%22:5}}} &output_mode=json’

D.  

‘http://localhost:8089/servicesNS/nobody/search/storage/collections/data/ employees?query={%22$and%22:[{%22rating%22:{%22$gte%22:2}},{%22rating%22:{% 22$lt%22:5}}]} &output_mode=json’

A.  

$$token_name$$

B.  

$token_name|h$

C.  

$token_name|n$

D.  

$token_name|u$

A.  

Convert searches to include NOT expressions.

B.  

Restrict the time range of the search as much as possible.

C.  

Replace | stats command with | transaction command wherever possible.

D.  

Convert the common SPL into a Global Search and convert the other searches to post-processing

searches.

A.  

Display the refresh time.

B.  

Show the Export Results button.

C.  

Show link buttons at the bottom of a panel.

D.  

Define an alternative search or target view to use.

A.  

Using the REST API.

B.  

Using the search job inspector.

C.  

Using the Splunk Monitoring Console.

D.  

Searching the Splunk logs using index=“ internal”.

A.  

Visualization event handler

B.  

Form input event handler

C.  

Condition event handler

D.  

Search event handler