19 Questions
Which search string returns events only from hostWWW3?
host=WWW3
By default, how long does Splunk retain a search job?
10 Minutes
What is required before an automatic lookup can be created? (Choose all that apply.)
The lookup definition must be created.
Which of the following Splunk components typically resides on the machines where data originates?
Forwarder
What is the purpose of regularly scheduled archiving in Splunk?
Moving to past or future events
After running a search in Splunk, what effect does clicking and dragging across the timeline have?
Moves to past or future events
Which command is used to review the contents of a specified static lookup file in Splunk?
inputlookup
In order to use a lookup table in Splunk, what must be done?
The lookup file must be uploaded to Splunk and a lookup definition must be created
When sorting on multiple fields with the sort command in Splunk, what delimiter can be used between the field names in the search?
,
Which time range picker configuration in Splunk would return real-time events for the past 30 seconds?
Real-time - Earliest: 30-seconds ago, Latest: Now
When writing searches in Splunk, which of the following is true about Booleans?
They must be lowercase.
Which of the following searches would return events with failure in index netfw or warn or critical in index netops?
(index=netfw failure) OR (index=netops (warn OR critical))
Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price
index=security sourcetype=access_* status=200 | stats count by price
Which of the following constraints can be used with the top command?
limit
When editing a dashboard, which of the following are possible options? (Choose all that apply.)
Modify the chart type displayed in a dashboard panel.
When running searches, command modifiers in the search string are displayed in what color?
Orange
Which of the following represents the Splunk recommended naming convention for dashboards?
Group_Object_Description
How can search results be kept longer than 7 days?
By changing the job settings.
Which of the following is a Splunk search best practice?
Filter as early as possible.
Test your knowledge of Splunk search queries and data retention with this quiz. From filtering search strings to understanding default retention periods, this quiz covers key concepts in Splunk data analysis and management.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
