Splunk automatically determines the source type for major data types.

• A.False
• B.True

Comment: *

Name: *

Email: *

Verification: *

Assuming a user has the capability to edit reports, which of the following are editable?

• A.Acceleration, schedule, permissions
• B.The report's name, acceleration, schedule
• C.The report's name, acceleration, permissions
• D.The report's name, schedule, permissions

Comment: *

Name: *

Email: *

Verification: *

Which search string returns a filed containing the number of matching events and names that field Event Count?

• A.index=security failure | stats count as "Event Count"
• B.index=security failure | stats sum as "Event Count"
• C.index=security failure | stats count by "Event Count"
• D.index=security failure | stats dc(count) as "Event Count"

Comment: *

Name: *

Email: *

Verification: *

What can be included in the All Fields option in the sidebar?

• A.Dashboards
• B.Metadata only
• C.Non-interesting fields
• D.Field descriptions

Comment: *

Name: *

Email: *

Verification: *

Splunk Components:
Which of the following are responsible for parsing incoming data and storing data on disc?

• A.indexers
• B.search heads
• C.forwarders

Comment: *

Name: *

Email: *

Verification: *