[2023年10月] 問題集練習試験問題学習ガイドはSPLK-1001試験合格させます
SPLK-1001問題集には練習試験問題解答
質問 # 56
When running searches command modifiers in the search string are displayed in what color?
- A. Orange
- B. Blue
- C. Highlighted
- D. Red
正解：B
質問 # 57
Which of the following is the best way to create a report that shows the last 24 hours of events?
- A. Set a real-time search over a 24-hour window
- B. Use earliest=-1d@d latest=@d
- C. Use the time range picket to select "Yesterday"
- D. Use the time range picker to select "Last 24 hours"
正解：D
質問 # 58
Which is a primary function of the timeline located under the search bar?
- A. To sort the events returned by the search command in chronological order
- B. To differentiate between structured and unstructured events in the data
- C. To zoom in and zoom out. although this does not change the scale of the chart
- D. To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime
正解：C
質問 # 59
Select the answer that displays the accurate placing of the pipe in the following search string:
index=security sourcetype=access_w status=200 stats count by price
- A. index=security sourcetype=access_* status=200 | stats count by price
- B. index=security sourcetype=access_* status=200 stats I count by price
- C. index=security sourcetype=access_" status=200 I stats count I by price
- D. index=security sourcetype=access_* I status=200 I stats count by price
正解：A
質問 # 60
What is the proper SPL terminology for specifying a particular index in a search?
- A. indexer-index_name
- B. index=index_name
- C. index name=index_name
- D. indexer name-index_name
正解：B
解説：
Explanation
This means that you can use the index field to filter your search results by the name of the index that contains the events you want to see.
For example, if you want to search for events in the index named "gcp_logs", you can use the following SPL:
index=gcp_logs
You can also specify multiple indexes by using the OR operator, such as:
index=gcp_logs OR index=oswin
質問 # 61
What is a suggested Splunk best practice for naming reports?
- A. Use a consistent naming convention so they are easily separated by characteristics such as group and object.
- B. Name reports as uniquely as possible with no overlap to differentiate them from one another.
- C. Any naming convention is fine as long as you keep an external spreadsheet to keep track.
- D. Reports are best named using many numbers so they can be more easily sorted.
正解：A
質問 # 62
@ Symbol can be used in advanced time unit option.
- A. No
- B. Yes
正解：B
質問 # 63
When is an alert triggered?
- A. When an event in a search matches up with a data model
- B. When Splunk encounters a syntax error in a search
- C. When a trigger action meets the predefined conditions
- D. When results of a search meet a specifically defined condition
正解：D
解説：
Explanation/Reference:
Reference:
+triggered+When+results+of+a+search+meet+a+specifically+defined
+condition&source=bl&ots=avtEx5luxo&sig=ACfU3U1ZVob_j9nU243Te2vhqwxI3YvJuA&hl=en&sa=X&ved=2a hUKEwjm48rmkfXoAhUlMewKHb_FAbkQ6AEwB3oECBYQJg
質問 # 64
Select the answer that displays the accurate placing of the pipe in the following search string:
index=security sourcetype=access_* status=200 stats count by price
- A. index=security sourcetype=access_* | status=200 | stats count by price
- B. index=security sourcetype=access_* status=200 | stats count by price
- C. index=security sourcetype=access_* status=200 | stats count | by price
- D. index=security sourcetype=access_* status=200 stats | count by price
正解：D
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Aboutsubsearches
質問 # 65
In the Search and Reporting app, which tab displays timecharts and bar charts?
- A. Statistics
- B. Patterns
- C. Events
- D. Visualization
正解：D
解説：
Explanation/Reference: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Aboutreportingcommands
質問 # 66
This is what Splunk uses to categorize the data that is being indexed.
- A. Index
- B. Host
- C. Source
- D. Sourcetype
正解：D
質問 # 67
The four types of Lookups that Splunk provides out-of-the-box are External, KV Store, Geospatial and which of the following?
- A. Correlated
- B. Total
- C. Segmented
- D. File-based
正解：D
解説：
Explanation
The four types of lookups that Splunk provides out-of-the-box are file-based, external, KV Store, and geospatial. File-based lookups use CSV files to map fields from your data to fields in the external table.
External lookups use Python scripts or binary executables to populate your events with field values from an external source. KV Store lookups use a key-value store to map fields from your data to fields in the external table. Geospatial lookups use KMZ or KML files to match location coordinates in your events to geographic feature collections1.
質問 # 68
Creating Data Models:
Object ATTRIBUTES do not define ___________.
- A. fields for the object
- B. a base search for the object
正解：B
質問 # 69
When an alert action is configured to run a script. Splunk must be able to locate the script. Which is one of the directories Splunk will look in to find the script?
- A. $SPLUNK_HOME/bin/scripts
- B. $SPLUNK_HOME/etc/scripts
- C. $SPLUNK_HOME/etc/scripts/bin
- D. $SPLUNK_HOME/bin/etc/scripts
正解：C
質問 # 70
What can be configured using the Edit Job Settings menu?
- A. Schedule the Job to re-run in 10 minutes
- B. Change Job Lifetime from 10 minutes to 7 days.
- C. Add the Job results to a dashboard
- D. Export the results to CSV format
正解：B
質問 # 71
How do you add or remove fields from search results?
- A. Use field + to add and field - to remove
- B. Use fields + to add and fields -to remove.
- C. Use fields Plus to add and fields Minus to remove
- D. Use table + to add and table - to remove
正解：B
質問 # 72
Creating Data Models:
Fields associated with a data set are known as ______.
- A. Constraints
- B. Attributes
正解：B
質問 # 73
What is a quick, comprehensive way to learn what data is present in a Splunk deployment?
- A. Review Splunk reports
- B. Run ./splunk show
- C. Click Data Summary in Splunk Web
- D. Search index=* sourcetype=* host=*
正解：C
解説：
Explanation/Reference: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/InheritedDeployment/Yourdata
質問 # 74
Which of the following searches would return events with failure in index netfw or warn :r critical in index netops?
- A. (index=netfw failure) OR index=r.etops OR (warn OR critical)
- B. (index=netfw failure) OR (index=netops (warn OR critical))
- C. (index=netfw failure) AND index=netops warn OR critical
- D. (index=netfw failure) AND (index=r.etops (warn OR critical))
正解：D
質問 # 75
Which of the following statements about case sensitivity is true?
- A. Field values ARE case sensitive; field names ARE NOT.
- B. Field names ARE case sensitive; field values are NOT.
- C. Both field names and field values ARE NOT case sensitive.
- D. Both field names and field values ARE case sensitive.
正解：B
質問 # 76
Which search will return the 15 least common field values for the dest_ipfield?
- A. sourcetype=firewall | rare last=15 dest_ip
- B. sourcetype=firewall | rare num=15 dest_ip
- C. sourcetype=firewall | rare count=15 dest_ip
- D. sourcetype=firewall | rare limit=15 dest_ip
正解：C
解説：
Explanation/Reference: https://answers.splunk.com/answers/41928/add-a-lookup-csv-colum-information-to-the-results-of- a-inputlookup-search.html
質問 # 77
In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?
- A. All non-indexed events to which the user has access will be returned.
- B. No events will be returned.
- C. Splunk will prompt you to specify an index.
- D. Events from every index searched by default to which the user has access will be returned.
正解：C
質問 # 78
Lookups allow you to overwrite your raw event.
- A. False
- B. True
正解：B
質問 # 79
......
SPLK-1001試験は、Splunkを使用してレポートとダッシュボードを検索し、フィールドエイリアスと計算を使用するために候補者の習熟度をテストするように設計されています。また、Splunkアーキテクチャ、データ入力、Splunkのユーザーインターフェイスの基本もカバーしています。この試験は、57分間続くオンラインの提案された試験であり、合格スコアは70％です。
無料Splunk Core Certified User SPLK-1001試験問題：https://jp.fast2test.com/SPLK-1001-premium-file.html