When an alert action is configured to run a script. Splunk must be able to locate the script. Which is one of the directories Splunk will look in to find the script?

• A.$SPLUNK_HOME/etc/scripts
• B.$SPLUNK_HOME/bin/scripts
• C.$SPLUNK_HOME/etc/scripts/bin
• D.$SPLUNK_HOME/bin/etc/scripts

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the recommended way to create multiple dashboards displaying data from the same search?

• A.Save the search as a report and use it in multiple dashboards as needed
• B.Export the results of the search to an XML file and use the file as the basis of the dashboards
• C.Save the search as a dashboard panel for each dashboard that needs the data
• D.Save the search as a scheduled alert and use it in multiple dashboards as needed

Comment: *

Name: *

Email: *

Verification: *

Which search will return only events containing the word "error" and display the results as a table that includes the fields named action, src, and dest?

• A.error | table action, src, dest
• B.error | tabular action, src, dest
• C.error | stats table action, src, dest
• D.error | table column=action column=src column=dest

Comment: *

Name: *

Email: *

Verification: *

Which statement is true about Splunk alerts?

• A.Alerts are based on searches and require cron to run on scheduled interval
• B.Alerts are based on searches and when triggered will only send an email notification.
• C.Alerts are based on searches that are either run on a scheduled interval or in real-time
• D.Alerts are based on searches that are run exclusively as real-time

Comment: *

Name: *

Email: *

Verification: *

Which of the following index searches would provide the most efficient search performance?

• A.index=*
• B.*index=sales AND index=web*
• C.index=web OR index=s*
• D.(index=web OR index=sales)

Comment: *

Name: *

Email: *

Verification: *