Splunk Udemy Answers

  • When looking at a dashboard panel that is based on a report, which of the following is true?

    • You can modify the search string in the panel, but you cannot change and configure the visualization.

  • How can a field be added to the fields sidebar?

    • Click All Fields and select the field to add it to Selected Fields.

  • In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?

    • If no index is specified during search, Splunk searches the default index. The specified index displays as the default in Splunk Manager settings. Default is main index.

  • Which of the following file types is an option for exporting Splunk search results?

    • XML, JSON, CSV

  • If the search is a saved search, such as a Report, what format can you export it as?

    • PDF

  • What are the default fields for interesting fields?

    • index

  • What are the default fields for selected fields?

    • host, source, sourcetype

  • Which statement is true about the top command?

    • It returns the count and percent columns per row.

    • It displays the output in table format. *

    • It returns the top 10 results.

  • Which of the following represents the Splunk recommended naming convention for dashboards?

    •  Group_Object_Description

  • When editing a dashboard, which of the following are possible options? (Choose all that apply.)

    •  Drag a dashboard panel to a different location on the dashboard.

    • Modify the chart type displayed in a dashboard panel.

  • What does the values function of the stats command do?

    • Lists unique values of a given field.

  • Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

    • (index=netfw failure) OR (index=netops (warn OR critical))

  • What can be configured using the Edit Job Settings menu?

    • Change Job Lifetime from 10 minutes to 7 days.

  • Which of the following describes lookup files?

    • Lookups add more fields to results returned by a search.

  • What must be done before an automatic lookup can be created? (Choose all that apply.)

    • The lookup definition must be created.

    • The lookup command must be used.

  • How can search results be kept longer than 7 days?

    • By scheduling a report.

  • What are the steps to schedule a report?

    • After saving the report

  • What is the purpose of using a by clause with the stats command?

    • To group the results by one or more fields