SPLK-1001 Search Practice Questions

What syntax is used to link key/value pairs in search strings?

• AA. action+purchase
• BB. action=purchase
• CC. action | purchase
• DD. action equal purchase

What type of search can be saved as a report?

• AA. Any search can be saved as a report.
• BB. Only searches that generate visualizations.
• CC. Only searches containing a transforming command.
• DD. Only searches that generate statistics or visualizations.

Which search matches the events containing the terms “error” and “fail”?

• AA. index=security Error Fail
• BB. index=security error OR fail
• CC. index=security “error failure”
• DD. index=security NOT error NOT fail

Which of the following is the recommended way to create multiple dashboards displaying data from the same search?

• AA. Save the search as a report and use it in multiple dashboards as needed.
• BB. Save the search as a dashboard panel for each dashboard that needs the data.
• CC. Save the search as a scheduled alert and use it in multiple dashboards as needed.
• DD. Export the results of the search to an XML file and use the file as the basis of the dashboards.