Online Access Free SPLK-1001 Practice Test

What must be done before an automatic lookup can be created? (select all that apply)

• A.The lookup definition must be created.
• B.The lookup file must be verified using the inputlookup command.
• C.The lookup command must be used.
• D.The lookup file must be uploaded to Splunk.

Which of the following commands will show the maximum bytes?

• A.sourcetype=access_* | maximum totals by bytes
• B.sourcetype=access_* | max(bytes)
• C.sourcetype=access_* | avg (bytes)
• D.sourcetype=access_* | stats max(bytes)

Which all time unit abbreviations can you include in Advanced time range picker? (Choose seven.)

• A.w
• B.m
• C.y
• D.mon
• E.d
• F.week
• G.yr
• H.s
• I.day
• J.h

Which search will return the 15 least common field values for the dest_ip field?

• A.sourcetype=firewall | rare limit=15 dest_ip
• B.sourcetype=firewall | rare num=15 dest_ip
• C.sourcetype=firewall | rare count=15 dest_ip
• D.sourcetype=firewall | rare last=15 dest_ip

Matching search terms are highlighted.

• A.Yes
• B.No