Splunk - Intro to Splunk Quiz

Which Splunk infrastructure component stores ingested data? (A) Datasets (B) Data models (C) Dashboards (D) Index

(D) Index

What determines the timestamp shown on returned events in a search? (A) Timestamps are displayed in Greenwich Mean Time (B) Timestamps are displayed in epoch time (C) The time zone where the event originated (D) The time zone defined in user settings

(D) The time zone defined in user settings

Which of the following searches will return results containing the phrase "failed password"? (A) "failed password" (B) failed password (C) `failed password` (D) (failed password)

(A) "failed password"

Which character is used in a search before a command? (A) A pipe (|) (B) A backtick (`) (C) A tilde (~) (D) A quotation mark (")

(A) A pipe (|)

What are the default roles in Splunk Enterprise? (A) Admin (B) Power (C) Manager (D) User

(A) Admin (B) Power (D) User

By default, which of the following roles are required to share knowledge objects? (A) Power (B) Admin (C) Manager (D) User

(A) Power (B) Admin

When a search is run, in what order are events returned? (A) Reverse chronological order (B) Reverse alphanumeric order (C) Chronological order (D) Alphanumeric order

(A) Reverse chronological order

Which command can be used to further filter results in a search? (A) Search (B) Subset (C) Filter (D) Subsearch

(A) Search

By default, who is able to view a saved report? (A) The user who created it (B) Any user with a power or admin role (C) Any user with a power or admin role (D) Any user with the viewreports capability

(A) The user who created it

Which of the following searches will return results containing the terms failed, password, or failed password? (A) failed OR password (B) failed password OR "failed password" (C) fail* (D) failed OR password OR "failed password"

(A) failed OR password (D) failed OR password OR "failed password"

Which of the following booleans can be used in a search? (A) ALSO (B) NOT (C) AND (D) OR

(B) NOT (C) AND (D) OR

What is the most efficient way to limit search results returned? (A) index (B) time (C) host (D) source

(B) time

By default, how long does a search job remain active? (A) 7 days (B) 30 minutes (C) 10 minutes

(C) 10 minutes

Which search mode behaves differently depending on the type of search being run? (A) Fast (B) variable (C) Smart (D) Verbose

(C) Smart

Which of the following searches will return results containing the words fail, failure, or failed? (A) fail+ (B) *fail (C) fail (D) fail*

(D) fail*