Customizing User Settings SPLK-1001 Practice Questions (Page 2)

Questions 6–10

1. 6expert · easy

   A user is changing their password in Splunk Web and receives an error message saying the password does not meet the complexity requirements. What should the user do?

   • AUse the same password as before, as it was accepted previously.
   • BContact the administrator to bypass the password policy.
   • CTry a different browser to see if the error is a browser issue.
   • DReview the password policy and create a new password that meets the requirements.
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A user wants to change their default app from 'Search & Reporting' to 'Splunk Enterprise Security'. They also want to verify their current time zone setting. Where can they do both in one place?

   • AIn the 'App' menu at the top of Splunk Web, under 'Manage Apps'.
   • BIn the 'Settings' menu, under 'Knowledge' and then 'Time Zone'.
   • CIn the user settings page, accessed by clicking the username in the top-right corner and selecting 'Edit Profile'.
   • DIn the 'Administrator' menu, under 'User Accounts'.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does a user change the default app that loads upon login in Splunk Web?

   • ABy editing the app's configuration file on the server.
   • BBy selecting a new app from the Default app dropdown on the user settings page.
   • CBy requesting the administrator to change it in Access Controls.
   • DBy using the App switcher and selecting 'Set as default'.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst in Singapore is reviewing firewall logs from a US-based office. The events show timestamps in UTC, but the analyst wants to correlate them with local incident reports that use Singapore Standard Time (UTC+8). The analyst's Splunk account currently displays all timestamps in UTC. What should the analyst do in Splunk Web to see the events in their local time?

   • AAdd a search-time extraction to convert the _time field to Asia/Singapore in the search.
   • BNavigate to Settings > Knowledge > Time Zone and set a global override for all users.
   • CUse the eval command with strftime to convert timestamps in every search manually.
   • DNavigate to Settings > User Preferences and change the Time Zone to Asia/Singapore.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A Splunk user is working with data from multiple sources: some logs are in UTC, some in EST, and some in PST. The user wants to see all timestamps in their local time zone (CST). They are aware that the data is stored in UTC. What is the correct approach?

   • AUse the 'convert' command in each search to convert timestamps to CST.
   • BAsk the administrator to change the global time zone setting.
   • CSet the Time Zone in user settings to 'America/Chicago' (CST).
   • DChange the time zone in the source configuration for each data input.
   Reveal Solution Discussion Select an answer first