An analyst wants to find events where the multi-value field `destinations` contains both `server1` and `server2` in the same event. Which search correctly achieves this?

destinations=server1 OR destinations=server2

destinations=server1 AND destinations=server2

A user runs a search and sees a field `error_code` in the results, but the user did not explicitly extract this field. The user wants to know if this field is available for filtering in the search. Which statement is true?

The field is only available for display, not for filtering.

The field is only available if the user runs the `fields` command.

The field is automatically extracted and can be used in the search to filter events.

The field is only available if the user runs the `eval` command.

What is a field alias in Splunk?

A field that is automatically created by Splunk for every event

An alternate name for an existing field

A field that is hidden from the search results by default

A field that contains the URL of the event's source

In Splunk, how do fields typically appear in search results?

Only as predefined fields that come with the Splunk installation

As a separate table that is not linked to the original events

As a single text string that must be parsed manually

As key-value pairs extracted from the raw event data

A company has a field `user_id` in their events, but they want to refer to it as `username` in their searches to make queries more readable. They do not want to change the underlying data. What should they configure?

Use the `eval` command to create a new field `username`

Create a field alias that maps `user_id` to `username`

Use the `rename` command in every search

Use the `fields` command to rename the field

SplunkCore Certified User

Domain 3Objective 2

Use Fields in Searches SPLK-1001 Practice Questions (Page 1)

Part of the Using Fields in Searches domain, which accounts for 20% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 11 practice questions to prepare you well beyond it. (estimate)

11questions here

3free pages

6concepts

20%of the exam

Questions 1–5

1application · medium
An analyst wants to find events where the multi-value field `destinations` contains both `server1` and `server2` in the same event. Which search correctly achieves this?
Select an answer first
2expert · medium
A user runs a search and sees a field `error_code` in the results, but the user did not explicitly extract this field. The user wants to know if this field is available for filtering in the search. Which statement is true?
Select an answer first
3foundation · easy
What is a field alias in Splunk?
Select an answer first
4foundation · easy
In Splunk, how do fields typically appear in search results?
Select an answer first
5application · medium
A company has a field `user_id` in their events, but they want to refer to it as `username` in their searches to make queries more readable. They do not want to change the underlying data. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.