How can results from a specified static lookup file be displayed?A . lookupcommandB . inputlookupcommandC . Settings > Lookups > InputD . Settings > Lookups > UploadView AnswerAnswer: B Explanation: Reference: https://answers.splunk.com/answers/30376/how-to-display-the-contents-of-a-lookup-file.html
Which Boolean operator is always implied between two search terms, unless otherwise specified?A . ORB . NOTC . ANDD . XORView AnswerAnswer: C Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Booleanexpressions
What must be done before an automatic lookup can be created? (Choose all that apply.)A . The lookup command must be used.B . The lookup definition must be created.C . The lookup file must...
What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?A . latest=-2hB . earliest=-2hC . latest=-2hour@dD . earliest=-2hour@dView AnswerAnswer: B Explanation:...
When looking at a dashboard panel that is based on a report, which of the following is true?A . You can modify the search string in the panel, and you can change and configure...
Which of the following searches would return events with failure in index netfw or warn or critical in index netops?A . (index=netfw failure) AND index=netops warn OR criticalB . (index=netfw failure) OR (index=netops (warn...
index=log sourcetype=error_log NOT status =100A . YesB . NoView AnswerAnswer: B
Which Field/Value pair will return only events found in the index named security?A . Index=SecurityB . index=SecurityC . Index=securityD . index!=SecurityView AnswerAnswer: B Explanation: Reference: https://answers.splunk.com/answers/712164/why-are-the-wineventlogssecurity-indexing-indiffe.html
Put query into separate lines where | (Pipes) are used by selecting following options.A . CTRL + EnterB . Shift + EnterC . Space + EnterD . ALT + EnterView AnswerAnswer: B
What is the default lifetime of every Splunk search job?A . All search jobs are saved for 10 daysB . All search jobs are saved for 10 hoursC . All search jobs are saved...
