Give Examples of Splunk Best Practices for Composing Efficient Searches. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which search component restricts the search to a specific data source?

   • A| head 100
   • B| sort -_time
   • Cindex=firewall sourcetype=cisco:asa
   • Dstats count by src_ip
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why should leading wildcards be avoided in Splunk searches?

   • AThey automatically switch the search to verbose mode
   • BThey cause the search to return duplicate results
   • CThey are not supported in Splunk searches
   • DThey force Splunk to scan all events in the index
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of command should be placed before a transforming command to improve search efficiency?

   • AStreaming commands
   • BSaving commands
   • CReporting commands
   • DTransforming commands
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst needs to run a search that only requires a count of events by source IP. The analyst does not need to see the individual events. Which search mode should the analyst use to optimize performance?

   • AFast mode
   • BPreview mode
   • CVerbose mode
   • DSmart mode
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which command ordering is most efficient for a search that needs to count events by source IP?

   • A| stats count by src_ip | where src_ip="10.0.0.0/24"
   • B| search src_ip="10.0.0.0/24" | stats count by src_ip
   • C| where src_ip="10.0.0.0/24" | stats count by src_ip
   • Dsrc_ip=10.0.0.0/24 | stats count by src_ip
   Reveal Solution Discussion Select an answer first