Splunk® SPLK-2001 Exam Practice Questions (P. 1)
- Full Access (70 questions)
- Six months of Premium Access
- Access to one million comments
- Seamless ChatGPT Integration
- Ability to download PDF files
- Anki Flashcard files for revision
- No Captcha & No AdSense
- Advanced Exam Configuration
Question #1
Suppose the following query in a Simple XML dashboard returns a table including hyperlinks:
<search>
<query>index news sourcetype web_proxy | table sourcetype title link
</query>
</search>
Which of the following is a valid dynamic drilldown element to allow a user of the dashboard to visit the hyperlinks contained in the link field?
<search>
<query>index news sourcetype web_proxy | table sourcetype title link
</query>
</search>
Which of the following is a valid dynamic drilldown element to allow a user of the dashboard to visit the hyperlinks contained in the link field?
- A<option name ג€link.openSearch.viewTarget">$row.link$</option>
- B<drilldown> <link target=ג€ blank">$$row.link$$</link> </drilldown>
- C<drilldown> <link target="_blank">$row.link|n$</link> </drilldown>Most Voted
- D<drilldown> <link target ג€_blank">http://localhost:8000/debug/refresh</link> </drilldown>
Correct Answer:
A
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/BuildandeditdashboardswithSimplifiedXML
A
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/BuildandeditdashboardswithSimplifiedXML
send
light_mode
delete
Question #2
When updating a knowledge object via REST, which of the following are valid values for the sharing Access Control List property?
- AApp
- BUser
- CGlobal
- DNobody
Correct Answer:
A
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing
A
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing
send
light_mode
delete
Question #3
Which of the following are ways to get a list of search jobs? (Select all that apply.)
- AAccess Activity > Jobs with Splunk Web.
- BUse Splunk REST to query the /services/search/jobs endpoint.
- CUse Splunk REST to query the /services/saved/searches endpoint.
- DUse Splunk REST to query the /services/search/sid/results endpoint.
Correct Answer:
AB
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/SupervisejobswiththeJobspage
AB
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/SupervisejobswiththeJobspage
send
light_mode
delete
Question #4
Which of the following are benefits from using Simple XML Extensions? (Select all that apply.)
- AAdd custom layouts.
- BAdd custom graphics.
- CAdd custom behaviors.
- DLimit Splunk license consumption based on host.
Correct Answer:
AC
Reference:
https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usewebframework/modifydashboards/
AC
Reference:
https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usewebframework/modifydashboards/
send
light_mode
delete
Question #5
How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)
- ANo need to do anything, it is turned on by default.
- BWhen a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1.Most Voted
- CWhen a new HEC token is created in Splunk Web, select the checkbox labeled ג€Enable indexer acknowledgementג€.Most Voted
- DWhen the Global Settings for HEC are updated in Splunk Web, select the checkbox labeled ג€Enable indexer acknowledgementג€.
Correct Answer:
CD
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/UsetheHTTPEventCollector
CD
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/UsetheHTTPEventCollector
send
light_mode
delete
All Pages