SPLK-1004 practice test

1. Question 1 · 1

   Which statement about tsidx files is accurate?

   Choose one answer.

   • Splunk updates tsidx files every 30 minutes.
   • Splunk removes outdated tsidx files every 5 minutes.
   • A tsidx file consists of a lexicon and a posting list.
   • Each bucket in each index may contain only one tsidx file.

2. Question 2 · 1

   What qualifies a report for acceleration?

   Choose one answer.

   • Fewer than 100k events in search results, with transforming commands used in the search string.
   • More than 100k events in search results, with only a search command in the search string.
   • More than 100k events in the search results, with a search and transforming command used in the search string.
   • Fewer than 100k events in search results, with only a search and transaction command used in the search string.

3. Question 3 · 1

   What happens to panels with post-processing searches when their base search is refreshed?

   Choose one answer.

   • The panels are deleted.
   • The panels are only refreshed if they have also been configured.
   • The panels are refreshed automatically.
   • Nothing happens to the panels.

4. Question 4 · 1

   How is a cascading input used?

   Choose one answer.

   • As part of a dashboard, but not in a form.
   • Without token notation in the underlying XML.
   • As a way to filter other input selections.
   • As a default way to delete a user role.

5. Question 5 · 1

   Which commands can run on both search heads and indexers?

   Choose one answer.

   • Transforming commands
   • Centralized streaming commands
   • Dataset processing commands
   • Distributable streaming commands

6. Question 6 · 1

   If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?

   Choose one answer.

   • Double tick marks around the nested macro.
   • A comma before the nested macro.
   • Square brackets around the nested macro.
   • A pipe character before the nested macro.

7. Question 7 · 1

   Which is a regex best practice?

   Choose one answer.

   • Use complex expressions rather than simple ones.
   • Avoid backtracking.
   • Use greedy operators (.*) instead of non-greedy operators (.*?).
   • Use * rather than +.

8. Question 8 · 1

   What does the query | makeresults generate?

   Choose one answer.

   • A timestamp
   • A results field
   • An error message
   • The results of the previously run search

9. Question 9 · 1

   Why use the tstats command?

   Choose one answer.

   • As an alternative to the summary command.
   • To generate statistics on indexed fields.
   • To generate an accelerated datamodel.
   • To generate statistics on search-time fields.

10. Question 10 · 1

    Repeating JSON data structures within one event will be extracted as what type of fields?

    Choose one answer.

    • Single value
    • Lexicographical
    • Multivalue
    • Mvindex

11. Question 11 · 1

    Which of the following can be used to access external lookups?

    Choose one answer.

    • Perl and Python
    • Python and Ruby
    • Perl and binary executable
    • Python and binary executable

12. Question 12 · 1

    Where does the output of an append command appear in the search results?

    Choose one answer.

    • Added as a column to the right of the search results.
    • Added as a column to the left of the search results.
    • Added to the beginning of the search results.
    • Added to the end of the search results.

13. Question 13 · 1

    How is regex passed to the makemv command?

    Choose one answer.

    • makemv must be preceded by the erex command.
    • It is specified by the delim argument.
    • It is specified by the tokenizer argument.
    • makemv must be preceded by the rex command.

14. Question 14 · 1

    If a search contains a subsearch, what is the order of execution?

    Choose one answer.

    • The order of execution depends on whether either search uses a stats command.
    • The inner search executes first.
    • The outer search executes first.
    • The two searches are executed in parallel.

15. Question 15 · 1

    Which field is required for an event annotation?

    Choose one answer.

    • annotation category
    • _time
    • eventtype
    • annotation label

Paid access to all 40 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.