Question 1

Splunk Parses data into individual events, extracts time, and assigns metadata.

Options :

A : False

B : True

Answer: B

Question 2

These users can create global knowledge objects. (Select all that apply.)

Options :

A : users

B : power users

C : administrators

Answer: B,C

Question 3

Which search matches the events containing the terms "error" and "fail"?

Options :

A : index=security Error Fail

B : index=security error OR fail

C : index=security “error failure”

D : index=security NOT error NOT fail

Answer: A

Question 4

How can search results be kept longer than 7 days?

Options :

A : By scheduling a report.

B : By creating a link to the job.

C : By changing the job settings.

D : By changing the time range picker to more than 7 days

Answer: A

Question 5

What kind of logs can Splunk Index?

Options :

A : Only A, B

B : Router and Switch Logs

C : Firewall and Web Server Logs

D : Only C

E : Database logs

F : All firewall, web server, database, router and switch logs

Answer: A