Which of the following is the best way to create a report that shows the last 24 hours of events?

• A.Use the time range picket to select "Yesterday"
• B.Set a real-time search over a 24-hour window
• C.Use earliest=-1d@d latest=@d
• D.Use the time range picker to select "Last 24 hours"

Comment: *

Name: *

Email: *

Verification: *

Selected fields are a set of configurable fields displayed for each event.

• A.True
• B.False

Comment: *

Name: *

Email: *

Verification: *

What must be done in order to use a lookup table in Splunk?

• A.The lookup file must be uploaded to the etc/apps/lookups folder for automatic ingestion
• B.The lookup file must be uploaded to Splunk and a lookup definition must be created
• C.The contents of the lookup file must be copied and pasted into the search bar.
• D.The lookup must be configured to run automatically

Comment: *

Name: *

Email: *

Verification: *

It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine.

• A.False
• B.True

Comment: *

Name: *

Email: *

Verification: *

Which of the following searches will return results where fail, 400, and error exist in every event?

• A.error AND (fail OR 400)
• B.error AND (fail AND 400)
• C.error OR fail OR 400
• D.error OR (fail and 400)

Comment: *

Name: *

Email: *

Verification: *