Splunk SPLK-2001 Quiz 2 Topic 10 Questions 6-10

Question: 1

There is a global search named ''global_search'' defined on a form as shown below:

index-_internal source-*splunkd.log | stats count by component, log_level

Which of the following would be a valid post-processing search? (Select all that apply.)

A| tstats count

Bsourcetype=mysourcetype

Cstats sum(count) AS count by log level

Dsearch log_level=error | stats sum(count) AS count by component

Show Answer

Question: 2

Which of the following options would be the best way to identify processor bottlenecks of a search?

AUsing the REST API.

BUsing the search job inspector.

CUsing the Splunk Monitoring Console.

DSearching the Splunk logs using index='' internal''.

Show Answer

Question: 3

Which of the following are characteristics of an add-on? (Select all that apply.)

ARequires navigation file.

BOccupies a unique namespace within Splunk.

CCan depend on add-ons for correct operation.

DContains technology or components not intended for reuse by other apps.

Show Answer

Question: 4

There is a global search named ''global_search'' defined on a form as shown below:

index-_internal source-*splunkd.log | stats count by component, log_level

Which of the following would be a valid post-processing search? (Select all that apply.)

A| tstats count

Bsourcetype=mysourcetype

Cstats sum(count) AS count by log level

Dsearch log_level=error | stats sum(count) AS count by component

Show Answer

Question: 5

When updating a knowledge object via REST, which of the following are valid values for the sharing Access Control List property?

AApp

BUser

CGlobal

DNobody

Show Answer

Splunk SPLK-2001 Quiz:2 Topic:10 Questions:6-10