SPLK-1001 無料問題集「Splunk Core Certified User」

（A）Yes

（B）No

（A）action

（B）index

（C）host

（D）_time

（A）False

（B）True

（A）Format Timeline: Hides or shows the timeline in different views.

（B）Zoom to selection: Narrows the time range and re-executes the search.

（C）Zoom-Out: Expands the time focus and doesn't re-executes the search.

（D）Zoom to selection: Narrows the time range and doesn't re-executes the search.

（E）Zoom-out: Expands the time focus and re-executes the search.

（A）The lookup file must be verified using the inputlookup command.

（B）The lookup definition must be created.

（C）The lookup file must be uploaded to Splunk.

（D）The lookup command must be used.

（A）&

（B）#

（C）@

（D）*

（A）At least five columns

（B）Source type

（C）Input filed

（D）Timestamp

（A）To find the least common values of a field in a dataset.

（B）To return only fields containing five of fewer values.

（C）To find the fields with the fewest number of values across a dataset.

（D）To sort field values in descending order.

（A）Yes

（B）No

（A）The number of unique values for the field

（B）The numeric non-unique values of the field

（C）The number of values for the field

（D）The value of the field

（A）Include at least one function as this is a search requirement

（B）Include all formatting commands before any search terms

（C）Include the search terms at the beginning of the search string

（D）Avoid using formatting clauses as they add too much overhead

（A）output

（B）input

（A）action

（B）bytes

（C）host

（D）owner