Free SPLK-1001 Exam Braindumps (page: 3)

Page 2 of 62

What type of search can be saved as a report?

  1. Any search can be saved as a report
  2. Only searches that generate visualizations
  3. Only searches containing a transforming command
  4. Only searches that generate statistics or visualizations

Answer(s): D

Explanation:

Only searches that generate statistics or visualizations can be saved as a report. These are searches that contain a transforming command, such as stats, chart, timechart, top, rare, etc. Transforming commands create a data table from the events and enable various types of visualizations. Searches that do not contain a transforming command can only be saved as an alert or a dashboard panel.


Reference:

Splunk Core User Certification Exam Study Guide, page 35.



What can be included in the All Fields option in the sidebar?

  1. Dashboards
  2. Metadata only
  3. Non-interesting fields
  4. Field descriptions

Answer(s): C



What syntax is used to link key/value pairs in search strings?

  1. action+purchase
  2. action=purchase
  3. action | purchase
  4. action equal purchase

Answer(s): B



When viewing the results of a search, what is an Interesting Field?

  1. A field that appears in any event
  2. A field that appears in every event
  3. A field that appears in the top 10 events
  4. A field that appears in at least 20% of the events

Answer(s): D






Post your Comments and Discuss Splunk® SPLK-1001 exam with other Community members:

SPLK-1001 Discussions & Posts