A user is looking at a search result and sees the field 'source' with a value of '/var/log/secure'. What does this tell the user?

The event has a sourcetype of /var/log/secure.

The event was generated by the host /var/log/secure.

The event is stored in the index /var/log/secure.

The event originated from the file /var/log/secure.

A user is new to Splunk and asks why some text in events is highlighted and clickable. What is the best explanation?

The highlighted text is always a default field.

The highlighted text is only for visual appeal.

Splunk automatically extracts fields from raw text, and these are highlighted to show the field-value pairs.

The highlighted text is random and has no meaning.

What happens when you click a field name in the Fields sidebar?

A popup appears showing the field's top values and a timeline

The field is immediately added to your search

A new search tab opens with that field

The field is removed from the sidebar

In the Fields sidebar, what distinguishes selected fields from interesting fields?

Selected fields are user-defined; interesting fields are automatically extracted

Selected fields are numeric; interesting fields are textual

Selected fields appear in every event; interesting fields appear in some events

Selected fields are visible in the table; interesting fields are only in the sidebar

A user runs a search and sees that the 'Selected Fields' list contains 'host', 'source', and 'sourcetype'. What is the most likely reason these fields are selected?

They are default fields that Splunk automatically selects for display.

The user manually selected them in a previous search.

They are the only fields that exist in the search results.

They are the most interesting fields in the search results.

SplunkCore Certified User

Domain 3Objective 1

Understand Fields SPLK-1001 Practice Questions (Page 2)

Part of the Using Fields in Searches domain, which accounts for 20% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

20%of the exam

Questions 6–10

6application · easy
A user is looking at a search result and sees the field 'source' with a value of '/var/log/secure'. What does this tell the user?
Select an answer first
7application · easy
A user is new to Splunk and asks why some text in events is highlighted and clickable. What is the best explanation?
Select an answer first
8foundation · easy
What happens when you click a field name in the Fields sidebar?
Select an answer first
9foundation · easy
In the Fields sidebar, what distinguishes selected fields from interesting fields?
Select an answer first
10application · easy
A user runs a search and sees that the 'Selected Fields' list contains 'host', 'source', and 'sourcetype'. What is the most likely reason these fields are selected?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.