This is what Splunk uses to categorize the data that is being indexed.

• A.Host
• B.Sourcetype
• C.Source
• D.Index

Comment: *

Name: *

Email: *

Verification: *

Which Field/Value pair will return only events found in the index named security?

• A.index!=Security
• B.index=Security
• C.Index=Security
• D.Index=security

Comment: *

Name: *

Email: *

Verification: *

Which of the following is true about user account settings and preferences?

• A.Time zones are automatically updated based on the setting of the computer accessing Splunk
• B.Full name time zone, and default app can be defined by clicking the login name in the Splunk bar
• C.Search & Reporting is the only app that can be set as the default application
• D.Full names can only be changed by accounts with a Power User or Admin role

Comment: *

Name: *

Email: *

Verification: *

After running a search, what effect does clicking and dragging across the timeline have?

• A.Filters current search results.
• B.Moves to past or future events.
• C.Executes a new search.
• D.Expands the time range of the search.

Comment: *

Name: *

Email: *

Verification: *

What is the purpose of using a by clause with the stats command?

• A.To group the results by one or more fields.
• B.To partition the input data based on the split-by fields.
• C.To compute numerical statistics on each field.
• D.To specify how the values in a list are delimited.

Comment: *

Name: *

Email: *

Verification: *