Free Practice Questions for Splunk SPLK-2001 Exam

 The correct answer is C and D, because trellis.name and trellis.value are the predefined drilldown tokens available specifically for trellis layouts. Trellis layouts are a way of displaying multiple charts in a grid, each with a different value of a split-by field. The trellis.name token returns the name of the split-by field, and the trellis.value token returns the value of the split-by field for the selected chart.

The correct answer is A, C, and D because these are the valid values for the sharing property of the Access Control List (ACL) when updating a knowledge object via REST. The sharing property determines the scope of the knowledge object and who can access it. The value of the User is not valid for the sharing property. You can find more information about the ACL and its properties in the Splunk REST API Reference Manual.

 The correct answer is A because using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in the $SPLUNK_HOME/etc/apps/myApp/local directory. The local directory is where Splunk stores the configuration files that are modified by the user, either through Splunk Web or by editing the files directly. The local directory has the highest priority in the configuration layering scheme, which means it overrides the settings in the default directory. The other options are incorrect because they either use the wrong directory or the wrong priority. You can find more information about the configuration files and the configuration layering scheme in the Splunk Developer Guide.

The correct answer is C, because the XML reference for the file myJS.js located in myOtherApp is . The script attribute specifies the path to the JavaScript file that contains the custom logic for the dashboard. The path must start with the app name, followed by a colon, and then the relative path to the file within the appserver/static folder of the app. The other options are incorrect because they either omit the app name, the colon, or the javascript subfolder.

The correct answer is A because the tstats command is a generating command. A generating command is a type of command that does not require a base search and can generate results from the summary data or the raw data. The tstats command is a generating command that can retrieve statistical information from the summary data, such as the accelerated data models or the data model summaries. The tstats command is similar to the stats command, but it is faster and more efficient, as it does not need to scan the raw data. The other options are incorrect because they are not the type of command that tstats is. Option B is incorrect because a transforming command is a type of command that converts the results into a data table with rows and columns. Option C is incorrect because a centralized streaming command is a type of command that processes the results on the search head, not on the indexers. Option D is incorrect because a distributable streaming command is a type of command that processes the results on the indexers, not on the search head. You can find more information about the tstats command and the types of commands in the Splunk Developer Guide.

 The correct answer is B and D, because they are the files within an app that contain permissions information. Permissions information refers to the access control settings for the app, such as who can read and write to the app, and whether the app is visible to all users or only to the app owner. The files that contain permissions information are the metadata/local.meta and metadata/default.meta files, which are located in the metadata folder of the app. The local/metadata.conf and default/metadata.conf files do not exist, and are not valid configuration files for an app.

 The valid syntax for specifying an absolute time range modifier in a search is earliest=01/01/2019T00:00:00. The T character separates the date and time components. The other options are invalid because they use either a colon or a space instead of a T. For more information, see Specify time modifiers in your search.

The correct answer is A because the /servicesNS/-/data/saved/searches/mySearch endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role. The /servicesNS/-/data/saved/searches endpoint returns information about saved searches in a specific namespace. The - symbol in the URI means that the user and app context are inherited from the current session. Therefore, a power user can access the saved search information by using the - symbol, assuming the permissions are set appropriately. The other options are incorrect because they either use invalid endpoints or do not specify the user and app context correctly. You can find more information about the /servicesNS endpoint and the namespace in the Splunk REST API Reference Manual.

When added to an app’s default.meta file, export = system makes one of its views available to other apps. This means that the view is visible and searchable by all users. The other options are invalid because export = app means that the view is visible and searchable only within the app, export = none means that the view is not visible or searchable by any user, and export = view is not a valid value for the export attribute. For more information, see About configuration file structure and inheritance.