exam questions

Exam SPLK-1001 All Questions

View all questions & answers for the SPLK-1001 exam

Exam SPLK-1001 topic 1 question 81 discussion

Actual exam question from Splunk's SPLK-1001
Question #: 81
Topic #: 1
[All SPLK-1001 Questions]

According to Splunk best practices, which placement of the wildcard results in the most efficient search?

  • A. f*il
  • B. *fail
  • C. fail*
  • D. *fail*
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
mirko1976
2 days, 6 hours ago
Selected Answer: C
• Avoid using wildcards at the beginning or middle of a string - Wildcards at beginning of string scan all events within timeframe - Wildcards in middle of string may return inconsistent results - So use fail* (not *fail or *fail* or f*il) • When possible, use OR instead of wildcards - For example, use (user=admin OR user=administrator) instead of user=admin*
upvoted 1 times
...
praveenjetty
7 months ago
C is correct. The best way to use a wildcard is at the end of a term
upvoted 2 times
...
mason999
7 months, 2 weeks ago
Selected Answer: A
A is correct
upvoted 1 times
Asheel1
5 months, 3 weeks ago
How is A correct? Any documentation?
upvoted 1 times
...
...
mikelord
3 years, 1 month ago
C is correct
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago