A Splunk admin needs to add support for a new data source that sends JSON logs. The admin wants to parse these logs into fields, but does not want to add any dashboards or user-facing features. What should the admin install?

A custom dashboard that includes the field extractions

A new index and a saved search to parse the data

An add-on that provides the input, parsing, and field extractions for the JSON data

An app that provides the input, parsing, and field extractions for the JSON data

A Splunk admin is creating a custom app and wants to include a set of field extractions that should be available globally across all apps. Where should the admin place these field extractions?

In the search head's etc directory

In the add-on's default directory

Which statement best describes what a Splunk app provides to users?

A tool to create new data sources that automatically send logs to Splunk

A set of pre-built dashboards and searches that help users analyze data for a specific purpose

A way to increase the storage capacity of Splunk indexes

A method to compress data before it is indexed to reduce disk usage

What is the main difference between a Splunk app and a Splunk add-on?

An app provides user interfaces and knowledge objects, while an add-on provides data inputs and parsing configurations

An app is a single file, while an add-on is a collection of multiple files

An app can only be installed on Splunk Cloud, while an add-on can only be installed on Splunk Enterprise

An app is free, while an add-on requires a separate license

SplunkCore Certified User

Domain 1Objective 3

Define Splunk Apps SPLK-1001 Practice Questions (Page 4)

Part of the Splunk Basics domain, which accounts for 5% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~1–2 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

4concepts

5%of the exam

Questions 16–20

16application · medium
A Splunk admin needs to add support for a new data source that sends JSON logs. The admin wants to parse these logs into fields, but does not want to add any dashboards or user-facing features. What should the admin install?
Select an answer first
17application · medium
A Splunk admin is creating a custom app and wants to include a set of field extractions that should be available globally across all apps. Where should the admin place these field extractions?
Select an answer first
18foundation · easy
Which statement best describes what a Splunk app provides to users?
Select an answer first
19foundation · easy
What must you do after installing a Splunk app to make it available to users?
Select an answer first
20foundation · easy
What is the main difference between a Splunk app and a Splunk add-on?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.