A user wants to see a list of all fields that are available in the search results, including those that are not currently displayed. Where should the user look?

The Fields sidebar, which shows Selected Fields and Interesting Fields.

In Splunk, what is a field?

A searchable name-value pair that provides structure to event data

A search command that transforms event data

A named location in the index where events are stored

A type of visualization used to display search results

After running a search, a user opens the Fields sidebar and sees a list of fields under 'Selected Fields' and a longer list under 'Interesting Fields'. The user wants to add a field from 'Interesting Fields' to the 'Selected Fields' section. What should the user do?

Run a new search that explicitly includes the field in the search string.

Use the 'Add to Selected' button in the search bar.

Click the field name in the Interesting Fields list to add it to Selected Fields.

Edit the event's raw text to include the field.

SplunkCore Certified User

Domain 3Objective 1

Understand Fields SPLK-1001 Practice Questions (Page 1)

Part of the Using Fields in Searches domain, which accounts for 20% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

20%of the exam

Questions 1–5

1application · easy
A user wants to see a list of all fields that are available in the search results, including those that are not currently displayed. Where should the user look?
Select an answer first
2foundation · easy
In Splunk, what is a field?
Select an answer first
3application · easy
After running a search, a user opens the Fields sidebar and sees a list of fields under 'Selected Fields' and a longer list under 'Interesting Fields'. The user wants to add a field from 'Interesting Fields' to the 'Selected Fields' section. What should the user do?
Select an answer first
4application · easy
A user is analyzing logs from multiple servers and wants to ensure that every event in the search results shows which server it came from. Which default field should the user check is selected?
Select an answer first
5foundation · easy
Which three fields does Splunk automatically add to every event at index time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.

Understand Fields SPLK-1001 Practice Questions (Page 1)

Questions 1–5

A user wants to see a list of all fields that are available in the search results, including those that are not currently displayed. Where should the user look?

In Splunk, what is a field?

After running a search, a user opens the Fields sidebar and sees a list of fields under 'Selected Fields' and a longer list under 'Interesting Fields'. The user wants to add a field from 'Interesting Fields' to the 'Selected Fields' section. What should the user do?

A user is analyzing logs from multiple servers and wants to ensure that every event in the search results shows which server it came from. Which default field should the user check is selected?

Which three fields does Splunk automatically add to every event at index time?

Keep studying — Using Fields in Searches