Splunk Core Certified User (SPLK-1001) Sample Questions

The well-respected Splunk certification programmes are designed to certify elite, highly sought-after people who are acknowledged by their peers in the industry as authorities in their field. The Splunk Core Certified User (SPLK-1001) exam is the last requirement for certification as a Splunk Core Certified User. This optional entry-level certification indicates a person’s fundamental proficiency with Splunk software navigation and use. To proceed, you can also start studying for the Splunk Core Certified Power User Exam. The article provides a list of Splunk Core Certified User (SPLK-1001) Sample Questions that cover core exam topics including –

• Introduction to Splunk’s interface
• Basic searching
• Using fields in searches
• Search fundamentals
• Transforming commands
• Creating reports and dashboards
• Creating and using lookups
• Scheduled reports
• Alerts
• Using Pivot

Advanced Sample Questions

What is the purpose of the ‘source’ field in Splunk?

• A) To identify the source of the data being indexed
• B) To determine the destination for the indexed data
• C) To specify the type of data being indexed
• D) To assign a unique identifier to the indexed data

Answer: A) To identify the source of the data being indexed

Explanation: The ‘source’ field in Splunk is used to identify the source of the data being indexed. This field is used to group data from a single source together, making it easier to search and analyze the data. The source field helps in defining different log sources, applications, and services that contribute to Splunk.

Reference: https://docs.splunk.com/Splexicon:Source

What is the difference between a real-time search and a historical search in Splunk?

• A) Real-time searches can only be run on live data, while historical searches can only be run on indexed data
• B) Real-time searches return results in real-time, while historical searches return results from past events
• C) Real-time searches are faster than historical searches
• D) Historical searches are more accurate than real-time searches

Answer: B) Real-time searches return results in real-time, while historical searches return results from past events

Explanation: A real-time search in Splunk is used to monitor and analyze live data as it comes in, while a historical search is used to search and analyze data that has already been indexed. Real-time searches are typically used for monitoring and alerting, while historical searches are used for deep analysis of past events.

Reference: https://docs.splunk.com/Documentation/Splunk/latest/Search/Realtimesearchvs.historicalsearch

Which Splunk component is responsible for indexing data?

• A) Search Head
• B) Indexer
• C) Forwarder
• D) Deployment Server

Answer: B) Indexer

Explanation: The indexer is the component of Splunk that is responsible for indexing data. It receives data from forwarders and other sources and indexes the data for search and analysis. The indexer is responsible for creating and maintaining the searchable indexes in Splunk.

Reference: https://docs.splunk.com/Splunk/7.3.1/Indexer/Introductiontotheindexer

Which command in Splunk is used to extract fields from raw data?

• A) stats
• B) rex
• C) eval
• D) field

Answer: B) rex

Explanation: The rex command in Splunk is used to extract fields from raw data. It uses regular expressions to extract field values from the data, which can then be used for search and analysis. A rex command is a powerful tool for manipulating and transforming data in Splunk.

Reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

Which type of Splunk license is required for a single user to use the Splunk Enterprise Security app?

• A) Splunk Enterprise license
• B) Splunk Cloud license
• C) Splunk Free license
• D) Splunk Enterprise Security license

Answer: A) Splunk Enterprise license

Explanation: The Splunk Enterprise Security app is a premium app that is available as an add-on to the Splunk Enterprise platform. To use the app, a user must have a valid Splunk Enterprise license. The Splunk Enterprise license provides access to all of the features and functionality of the Splunk platform, including the Enterprise Security app.

Reference: https://www.splunk.com/en_us/legal/splunk-software-license-agreement.html

What is the purpose of a Splunk Forwarder?

• A) To index data
• B) To search and analyze data
• C) To forward data to the Indexer
• D) To create reports and dashboards

Answer: C) To forward data to the Indexer

Explanation: A Splunk Forwarder is a component that is responsible for forwarding data from the source to the Indexer. It is installed on the source machine and is used to collect data from log files, network devices, and other sources, and forward it to the Indexer for indexing and analysis.

Reference: https://docs.splunk.com/Splunk/7.3.1/Data/HowSplunkEnterprisecollectsdata

Which Splunk component is responsible for managing user authentication and access control?

• A) Deployment Server
• B) Search Head
• C) Indexer
• D) License Master

Answer: B) Search Head

Explanation: The Search Head is the component of Splunk that is responsible for managing user authentication and access control. It determines which users can access which data and which features of Splunk. It also manages user roles and permissions.

Reference: https://docs.splunk.com/Splunk/7.3.1/Security/Aboutsecurityandauthentication

Which Splunk command is used to filter search results based on specific criteria?

• A) stats
• B) where
• C) rex
• D) eval

Answer: B) where

Explanation: The where command in Splunk is used to filter search results based on specific criteria. It is used to specify one or more conditions that must be met in order for a result to be included in the final set. The where command can be used in conjunction with other commands to refine search results.

Reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

Which type of Splunk search is used to identify patterns and anomalies in data?

• A) Scheduled search
• B) Real-time search
• C) Ad-hoc search
• D) Machine learning search

Answer: D) Machine learning search

Explanation: Machine learning searches in Splunk are used to identify patterns and anomalies in data. They use machine learning algorithms to detect trends, outliers, and other patterns in the data. Machine learning searches can be used to predict future events, detect anomalies, and identify new patterns.

Reference: https://docs.splunk.com/Documentation/MLApp/latest/User/WhatisML

Which type of Splunk visualization is used to display the distribution of data across different categories?

• A) Pie chart
• B) Bar chart
• C) Line chart
• D) Scatter chart

Answer: A) Pie chart

Explanation: A pie chart in Splunk is used to display the distribution of data across different categories. It is a circular chart that is divided into slices, with each slice representing a category of data. The size of each slice represents the proportion of data in that category.

Reference: https://docs.splunk.com/Documentation/Splunk/8.1.1/Viz/ChartReference/Piechart

Basic Sample Questions

Q1) Which search term only displays results for hostWWW3 events?

• A. host=*
• B. host=WWW3
• C. host=WWW*
• D. Host=WWW3

Correct Answer: B

Q2) How long does Splunk keep a search job on file by default?

• A. 10 Minutes
• B. 15 Minutes
• C. 1 Day
• D. 7 Days

Correct Answer: A

Q3) What needs to be done in order to generate an automatic lookup? (Select each that applies.)

• A. You must use the lookup command.
• B. The definition for the lookup must be made.
• C. Splunk must get the lookup file.
• D. The inputlookup command must be used to validate the lookup file.

Correct Answer: B

Q4) What needs to be done in order to generate an automatic lookup? (Select each that applies.)

• A. Indexer
• B. Forwarder
• C. Search head
• D. Deployment server

Correct Answer: B

Q5) What establishes the extent of the data that is included in a scheduled report?

• A. The report will include all information that the User role has access to.
• B. The report will contain all information that is available to the report’s owner.
• C. Until the report is run again, all data that is accessible to all users will appear in it.
• D. The report’s owner can set permissions such that the report runs with either the owner’s profile or the user role.

Correct Answer: D

Q6) Which of the following statements regarding Booleans is accurate when creating searches in Splunk?

• A. Lowercase letters are required.
• B. They have to be capitalised.
• C. They have to be surrounded by quotes.
• D. Parentheses are required.

Correct Answer: B

Q7) Which of the following searches would produce results for events that had failure, warn, or critical status in the index netops?

• A. (index=netfw failure) AND index=netops warn OR critical
• B. (index=netfw failure) OR (index=netops (warn OR critical))
• C. (index=netfw failure) AND (index=netops (warn OR critical))
• D. (index=netfw failure) OR index=netops OR (warn OR critical)

Correct Answer: B

Q8) In the following search term, choose the response that shows the pipe’s precise placement: index=security status=200 stats count by price sourcetype=access_*

• A. index=security sourcetype=access_* status=200 stats | count by price
• B. index=security sourcetype=access_* status=200 | stats count by price
• C. index=security sourcetype=access_* status=200 | stats count | by price
• D. index=security sourcetype=access_* | status=200 | stats count by price

Correct Answer: B

Q9) Which of the ensuing restrictions can be utilised in conjunction with the top command?

• A. limit
• B. useperc
• C. addtotals
• D. fieldcount

Correct Answer: A

Q10) Which of the following are potential possibilities when editing a dashboard? (Select each that applies.)

• A. Add an output.
• B. Export a dashboard panel.
• C. Modify the chart type displayed in a dashboard panel.
• D. Drag a dashboard panel to a different location on the dashboard.

Correct Answer: C

Q11) What colour is displayed when searching with command modifiers in the search string?

• A. Red
• B. Blue
• C. Orange
• D. Highlighted

Correct Answer: C

Q12) Which of the following best exemplifies the Splunk suggested dashboard naming structure?

• A. Description_Group_Object
• B. Group_Description_Object
• C. Group_Object_Description
• D. Object_Group_Description

Correct Answer: C

Q13) How are search results maintained for more than seven days?

• A. By scheduling a report.
• B. By creating a link to the job.
• C. By changing the job settings.
• D. By changing the time range picker to more than 7 days.

Correct Answer: C

Q14) Which of the following best practises for Splunk searches?

• A. Filter as soon as you can.
• B. Only ever specify one index.
• C. Use the fewest number of search terms possible.
• D. To get more relevant search results, use wildcards.

Correct Answer: A

Q15)Which of the following is true while looking at a dashboard panel that is based on a report?

• A. You can modify the search string in the panel, and you can change and configure the visualization.
• B. You can modify the search string in the panel, but you cannot change and configure the visualization.
• C. You cannot modify the search string in the panel, but you can change and configure the visualization.
• D. You cannot modify the search string in the panel, and you cannot change and configure the visualization.

Correct Answer: C

Q16) Which of the following describe common top command restrictions?

• A. limit, count
• B. limit, showpercent
• C. limits, countfield
• D. showperc, countfield

Correct Answer: C

Q17) Which of the following is true of line charts when showing search results?

• A. Single and multiple series work best with line charts. Manyest Votes
• B. When using Fast mode, line charts are best for single series.
• C. For many series with three or more columns, line charts are the best option.
• D. Multiseries searches with at least two or more columns work best with line charts.

Correct Answer: C

Q18) How are events shown when a search has been performed in Splunk Core Certified User (SPLK-1001) ?

• A. In chronological order.
• B. Randomly by default.
• C. In reverse chronological order.
• D. Alphabetically according to field name.

Correct Answer: C

Q19) Which of the following statements regarding user preferences and settings is accurate inSplunk Core Certified User (SPLK-1001) ?

• A. The only programme that may be made the default is Search & Reporting.
• B. Accounts with the Power User or Admin capacity are the only ones who can modify full names.
• C. Depending on the configuration of the machine accessing Splunk, time zones are automatically updated.
• D. By selecting the login name in the Splunk bar, you can choose the full name, time zone, and default app.

Correct Answer: D

Q20) What is a scheduled report’s main purpose?

• A. Auto-detect performance changes.
• B. Automatically produced PDF reports on general data trends.
• C. Scheduled archiving to minimise the consumption of disc space
• D. Setting off an alert in your Splunk instance when specific criteria are satisfied.

Correct Answer: D