A user has a saved search that they run frequently, but they often need to modify the search slightly each time. They want to save the modified search as a new saved search without affecting the original. What is the best way to do this?

Copy the search string from the saved search, modify it, and save it as a new saved search

Run the saved search, modify it in the search bar, and then save it as a new saved search

Use the 'Save As' option when running the saved search

Edit the original saved search and then save it

A network administrator wants to search for all firewall events from the last 30 minutes. They are currently viewing the search page with the default time range set to 'Last 15 minutes'. What is the most efficient way to adjust the time range?

Type 'earliest=-30m latest=now' in the search bar

Change the time range to 'All time' and then filter by the _time field

Use the 'Custom' option and enter the exact start and end times

Use the time range picker and select 'Last 30 minutes'

SplunkCore Certified User

Domain 2Objective 1

Run Basic Searches SPLK-1001 Practice Questions (Page 3)

Part of the Basic Searching domain, which accounts for 22% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~6–9 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

5concepts

22%of the exam

Questions 11–15

11foundation · easy
A user needs to run a search that returns ALL fields for every event, including fields that are not explicitly referenced in the search. Which search mode should be selected?
Select an answer first
12foundation · easy
Which search would return events that contain the word 'failed' but do NOT contain the word 'success'?
Select an answer first
13expert · hard
A user has a saved search that they run frequently, but they often need to modify the search slightly each time. They want to save the modified search as a new saved search without affecting the original. What is the best way to do this?
Select an answer first
14application · easy
A network administrator wants to search for all firewall events from the last 30 minutes. They are currently viewing the search page with the default time range set to 'Last 15 minutes'. What is the most efficient way to adjust the time range?
Select an answer first
15foundation · easy
Where can a user find a list of all searches they have run in the current Splunk session?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.

Run Basic Searches SPLK-1001 Practice Questions (Page 3)

Questions 11–15

A user needs to run a search that returns ALL fields for every event, including fields that are not explicitly referenced in the search. Which search mode should be selected?

Which search would return events that contain the word 'failed' but do NOT contain the word 'success'?

A user has a saved search that they run frequently, but they often need to modify the search slightly each time. They want to save the modified search as a new saved search without affecting the original. What is the best way to do this?

A network administrator wants to search for all firewall events from the last 30 minutes. They are currently viewing the search page with the default time range set to 'Last 15 minutes'. What is the most efficient way to adjust the time range?

Where can a user find a list of all searches they have run in the current Splunk session?

Keep studying — Basic Searching