Splunk SPLK-2001 Quiz 2 Topic 10 Questions 6-10

Question: 1

There is a global search named ''global_search'' defined on a form as shown below:

index-_internal source-*splunkd.log | stats count by component, log_level

Which of the following would be a valid post-processing search? (Select all that apply.)

A| tstats count

Bsourcetype=mysourcetype

Cstats sum(count) AS count by log level

Dsearch log_level=error | stats sum(count) AS count by component

Show Answer

Question: 2

Which of the following options would be the best way to identify processor bottlenecks of a search?

AUsing the REST API.

BUsing the search job inspector.

CUsing the Splunk Monitoring Console.

DSearching the Splunk logs using index='' internal''.

Show Answer

Question: 3

Which of the following are characteristics of an add-on? (Select all that apply.)

ARequires navigation file.

BOccupies a unique namespace within Splunk.

CCan depend on add-ons for correct operation.

DContains technology or components not intended for reuse by other apps.

Show Answer

Question: 4

There is a global search named ''global_search'' defined on a form as shown below:

index-_internal source-*splunkd.log | stats count by component, log_level

Which of the following would be a valid post-processing search? (Select all that apply.)

A| tstats count

Bsourcetype=mysourcetype

Cstats sum(count) AS count by log level

Dsearch log_level=error | stats sum(count) AS count by component

Show Answer

Question: 5

Searching ''index=_internal metrics | head 3'' from Splunk Web returned the following events:

04-12-2018 18:39:43.514 +0200 INFO Metrics -- group=thruput, name=thruput, instantaneous_kbps=0.9651774014563425, instantaneous_eps=5.645638802094809, average_kbps=1.198995639527069, total_k_processed=2676, kb=29.91796875, ev=175, load_average=3.85888671875

04-12-2018 18:39:43.514 +0200 INFO Metrics -- group_thruput, name_syslog_output, instantaneous_kbps=0, instantaneous_eps_0, average_kbps=0, total_k_processed=0, kb=0, ev=0

04-12-2018 18:39:43.513 +0200 INFO Metrics -- group_thruput, name_index_thruput, instantaneous_kbps=0.9651773703189551, instantaneous_eps=4.87137960922438, average_kbps=1.1985932324065556, total_k_processed=2675, kb=29.91796875, ev=151

When the same search is required from a REST API call, which fields will be given? (Select all that apply.)

A_raw

Bname

Csourcetype

Dinstantaneous_kbps

Show Answer

Splunk SPLK-2001 Quiz:2 Topic:10 Questions:6-10