Splunk Core Certified User (SPLK-1001) practice questions

Exam overview SPLK-1001

Domain coverage 8 domains

• Splunk Basics (5%)
• Basic Searching (22%)
• Using Fields in Searches (20%)
• Search Language Fundamentals (15%)
• Transforming Commands (15%)
• Creating Reports and Dashboards (12%)
• Working with Lookups (6%)
• Scheduled Reports and Alerts (5%)

Sample questions 10 of 100 shown

1. Q1 Splunk Basics (5%)

   What is the default web port used by Splunk?

   1. 8089
   2. 8000
   3. 8080
   4. 443

   Splunk Web runs on port 8000 by default. Port 8089 is the management port used for REST API communication, port 8080 is a common alternative web server port, and port 443 is the standard HTTPS port.
2. Q2 Splunk Basics (5%)

   Which Splunk component is typically installed on the machine where data originates?

   1. Indexer
   2. Forwarder
   3. Search Head
   4. Deployment Server

   The Forwarder is a lightweight Splunk component designed to reside on the data source machine. It consumes minimal resources and collects, then forwards data to an indexer for processing and storage.
3. Q3 Splunk Basics (5%)

   What is the default application in Splunk Enterprise?

   1. Splunk Enterprise Security Suite
   2. Searching and Reporting
   3. Reporting and Searching
   4. Splunk Security App

   The "Searching and Reporting" application is the default app in Splunk Enterprise. It provides the primary interface for searching, analyzing, and visualizing machine data.
4. Q4 Splunk Basics (5%)

   Splunk parses data into individual events, extracts timestamps, and assigns metadata.

   1. False
   2. True

   During indexing, Splunk processes incoming data by parsing it into individual events, extracting timestamps, and assigning metadata such as host, source, and sourcetype.
5. Q5 Splunk Basics (5%)

   Splunk's documentation can be found at docs.splunk.com.

   1. True
   2. False

   Splunk maintains its official product documentation at docs.splunk.com, which covers all versions of Splunk Enterprise, Splunk Cloud, and related products.
6. Q6 Basic Searching (22%)

   How does Splunk display data by default?

   1. ASCII character order
   2. Reverse chronological order
   3. Alphanumeric order
   4. Chronological order

   Splunk displays search results in reverse chronological order by default, with the most recent events appearing first. This helps users quickly see the latest data.
7. Q7 Basic Searching (22%)

   Where in the Splunk search interface does a user specify the time range for a search?

   1. Using the timerange command in the search bar
   2. In the time range picker to the right of the search bar
   3. In the Settings menu under Search Preferences
   4. The time range must be specified in the search query using earliest and latest

   The time range picker is located to the right of the search bar. It allows users to quickly select predefined time ranges (e.g., Last 24 hours, Last 7 days) or specify custom time ranges.
8. Q8 Basic Searching (22%)

   A search returns many events. The user wants to see if results are concentrated around a specific time. Which part of the search page helps with this?

   1. Timeline
   2. App icon
   3. License stack
   4. Deployment client settings

   The timeline displays the distribution of events over time and helps users zoom into specific time periods. Peaks and valleys in the timeline indicate event volume changes.
9. Q9 Basic Searching (22%)

   When you hover over search results, keywords are highlighted and you can click on a result to perform which actions? (Choose three.)

   1. Open a new search
   2. Exclude the item from the search
   3. None of the above
   4. Add the item to the search

   When keywords are highlighted in search results, clicking on them provides options to add the term to the current search, exclude the term from the search, or open a new search with that term.
10. Q10 Basic Searching (22%)

    A user wants to limit a search to events from the past 24 hours. What is the best approach?

    1. Change the browser zoom level
    2. Delete older indexed events
    3. Use the field sidebar only
    4. Set the time range picker or specify the time range in the search

    The time range picker or specifying earliest and latest in the SPL is the proper way to limit a search to a specific time window. This filters results without altering or deleting data.

Answer all 100 questions with instant feedback →

Reader reviews 343 ratings

• Bought the SPLK-1001 pack last month and honestly the detailed explanations are where this really shines.

  ★★★★★★ Ethan C.

• The SPLK-1001 questions were tougher than the actual exam, which honestly made me more confident. Great prep tool.

  ★★★★★★ Brandon L.

• I was nervous about the SPLK-1001 exam because it had been years since my last cert. These questions got me back on track fast.

  ★★★★★★ Aurora C.

• Solid prep material for SPLK-1001. The questions feel like they were written by someone who actually teaches this stuff.

  ★★★★★★ Brooklyn T.

• The SPLK-1001 explanations are where this really stands out. Not just which answer is right but WHY the others are wrong.

  ★★★★★★ Aria H.

• Passed the SPLK-1001 exam today! The scenario-based questions here were extremely similar to what I saw on the test.

  ★★★★★ Riley B.

Frequently asked questions

More Splunk exams