A user is looking at a search result and sees a field called 'status' with a value of '200'. The user wants to understand what this means. Which statement is true?

The field 'status' is a default field that always has a value of 200.

The field 'status' is the same as the sourcetype.

The field 'status' is only visible in the raw event text.

The field 'status' has a value of '200', indicating an HTTP status code.

A user is looking at the Fields sidebar and sees a field called 'status' under 'Interesting Fields'. The user wants to see the distribution of status values in the search results. What is the most efficient way to do this?

Click the 'status' field in the Fields sidebar.

Add 'status' to Selected Fields and then look at the events list.

Run a search with 'status=*' and look at the events.

Use the 'Fields' menu to export the field.

A user runs a search and notices that the Fields sidebar shows a field called 'clientip' under 'Interesting Fields'. The user wants to see the top 10 values for this field. What is the most direct way to do this?

Run a search with the command 'top clientip'.

Click the field name 'clientip' in the Fields sidebar.

Type 'clientip' into the search bar and run the search.

Use the 'Fields' menu in the top navigation bar.

A user is looking at a search result and sees the following text: 'status=404 bytes=512'. What does this represent?

Two fields named 'status=404' and 'bytes=512'.

A single field-value pair with the field 'status=404 bytes' and value '512'.

A raw event with no extracted fields.

Two field-value pairs: status has a value of 404, and bytes has a value of 512.

SplunkCore Certified User

Domain 3Objective 1

Understand Fields SPLK-1001 Practice Questions (Page 4)

Part of the Using Fields in Searches domain, which accounts for 20% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

20%of the exam

Questions 16–20

16application · easy
A security analyst runs a search over firewall logs and sees events in the results list. To quickly identify which device generated each event without opening individual events, the analyst looks at the fields displayed under each event. Which default fields would be visible for every event?
Select an answer first
17application · easy
A user is looking at a search result and sees a field called 'status' with a value of '200'. The user wants to understand what this means. Which statement is true?
Select an answer first
18application · easy
A user is looking at the Fields sidebar and sees a field called 'status' under 'Interesting Fields'. The user wants to see the distribution of status values in the search results. What is the most efficient way to do this?
Select an answer first
19application · easy
A user runs a search and notices that the Fields sidebar shows a field called 'clientip' under 'Interesting Fields'. The user wants to see the top 10 values for this field. What is the most direct way to do this?
Select an answer first
20application · easy
A user is looking at a search result and sees the following text: 'status=404 bytes=512'. What does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.