What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

Alatest=-2h

Bearliest=-2h

Clatest=-2hour@d

Dearliest=-2hour@d

Answer : B

Explanation/Reference: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Specifytimemodifiersinyoursearch

Which of the following is a Splunk internal field?

A_raw

Bhost

C_host

Dindex

Answer : A

Which command will rename action to Customer Action?

A| rename action = CustomerAction

B| rename Action as ''Customer Action''

C| rename Action to ''Customer Action''

D| rename action as ''Customer Action''

Answer : D

Explanation/Reference: Reference: https://answers.splunk.com/answers/610038/understanding-command-in-search.html

Which of the following is the most efficient search?

Aindex=* ''failed password''

B''failed password'' index=*

C(index=* OR index=security) ''failed password''

Dindex=security ''failed password''

Answer : A

Which of the following is a correct way to limit search results to display the 5 most common values of a field?

A| rare top=5

B| top rare=5

C| top limit=5

D| rare limit=5

Answer : C

Free Practice Questions for Splunk SPLK-1001 Exam