SPLUNK Core Certified User New Exam Overview Questions and Answers Solution

SPLUNK Core Certified User New Exam Overview Questions and Answers Solution

M3: What is a Splunk App? - A pre configured environment that stays at the top of Splunk instance to extend Splunk capabilities. Imagine a app like a work space, build to solve a specific use case. M3: What are the main roles of Splunk Enterprise ? - Admin, Power and User M3: What kind of permissions each role has ? - Admin: Can install apps, create knowledge objects for all users. Power: Can create and share knowledge objects with users in the app and perform realtime searches. User: Can see only their own objects and objects shared with them. M3: What apps comes out of the box with Splunk ? - Home app: Gives you a quick place to explore Splunk Search and Report: Give you a quick place to search for logs and create reports. M4: What are the 3 main ways to ingest data to Splunk ? - Upload, Monitor and Forward M4: What is a sourcetype ? - A way to categorize and define rules to the data being send to Splunk. When adding new data, Splunk will try recognize the format and set a pre-defined Sourcetype. Sourcetypes can be configure at the application context or system wide. M4: What are a few ways to set the hostname when adding new data - Constante value, Regular expression path or Segment in path. M4: What are indexes ? - Are directories where the data will be stored. M4: Why use multiple indexes ? - To make the search more efficient, limit user access, set custom retention policies. M5: The 7 components of the Search and Report app are: - 1. The Splunk bar 2. The app bar 3. The search bar 4. The time picker 5. The "How to search" panel 6. The "What to search" panel 7. The search history M5: Commands that create statistics and visualizations are called: - Transforming commands