March Special Sale - Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 575363r9

Welcome To DumpsPedia

SPLK-1002 Sample Questions Answers

Questions 4

Which of the following statements describe calculated fields? (select all that apply)

Options:

A.

Calculated fields can be used in the search bar.

B.

Calculated fields can be based on an extracted field.

C.

Calculated fields can only be applied to host and sourcetype.

D.

Calculated fields are shortcuts for performing calculations using the eval command.

Buy Now
Questions 5

What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Options:

A.

Macros.

B.

Field aliases.

C.

The rename command.

D.

CIM does not work with different names for the same field.

Buy Now
Questions 6

Which of the following searches will return events contains a tag name Privileged?

Options:

A.

Tag= Priv

B.

Tag= Pri*

C.

Tag= Priv*

D.

Tag= Privileged

Buy Now
Questions 7

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Options:

A.

Index-main | REJECT trans sessionid

B.

Index-main | transaction sessionid | search REJECT

C.

Index=main | transaction sessionid | whose transaction=reject

D.

Index=main | transaction sessionid | where transaction=reject’’

Buy Now
Questions 8

A space is an implied _____ in a search string.

Options:

A.

OR

B.

AND

C.

()

D.

NOT

Buy Now
Questions 9

Which of the following statements describe GET workflow actions?

Options:

A.

GET workflow actions must be configured with POST arguments.

B.

Configuration of GET workflow actions includes choosing a sourcetype.

C.

Label names for GET workflow actions must include a field name surrounded by dollar signs.

D.

GET workflow actions can be configured to open the URT link in the current window or in a new window

Buy Now
Questions 10

Which of the following statements describe the search below? (select all that apply)

Index=main I transaction clientip host maxspan=30s maxpause=5s

Options:

A.

Events in the transaction occurred within 5 seconds.

B.

It groups events that share the same clientip and host.

C.

The first and last events are no more than 5 seconds apart.

D.

The first and last events are no more than 30 seconds apart.

Buy Now
Questions 11

Which of the following statements describes POST workflow actions?

Options:

A.

POST workflow actions are always encrypted.

B.

POST workflow actions cannot use field values in their URI.

C.

POST workflow actions cannot be created on custom sourcetypes.

D.

POST workflow actions can open a web page in either the same window or a new .

Buy Now
Questions 12

Which of the following file formats can be extracted using a delimiter field extraction?

Options:

A.

CSV

B.

PDF

C.

XML

D.

JSON

Buy Now
Questions 13

Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Options:

A.

Convert_sales (euro, €, 79)”

B.

Convert_sales (euro, €, .79)

C.

Convert_sales ($euro,$€$,s79$

D.

Convert_sales ($euro, $€$,S,79$)

Buy Now
Questions 14

When should you use the transaction command instead of the scats command?

Options:

A.

When you need to group on multiple values.

B.

When duration is irrelevant in search results. .

C.

When you have over 1000 events in a transaction.

D.

When you need to group based on start and end constraints.

Buy Now
Questions 15

Which of the following can be used with the eval command tostring function (select all that apply)

Options:

A.

‘’hex’’

B.

‘’commas’’

C.

‘’Decimal’’

D.

‘’duration’’

Buy Now
Questions 16

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Options:

A.

Both will appear in the All Fields list, but only if the alias is specified in the search.

B.

Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

C.

The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

D.

The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Buy Now
Questions 17

Which of the following statements about data models and pivot are true? (select all that apply)

Options:

A.

They are both knowledge objects.

B.

Data models are created out of datasets called pivots.

C.

Pivot requires users to input SPL searches on data models.

D.

Pivot allows the creation of data visualizations that present different aspects of a data model.

Buy Now
Questions 18

What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Options:

A.

Custom visualizations

B.

Pre-configured data models

C.

Fields and event category tags

D.

Automatic data model acceleration

Buy Now
Questions 19

When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

Options:

A.

Rank

B.

Weight

C.

Priority

D.

Precedence

Buy Now
Questions 20

Which are valid ways to create an event type? (select all that apply)

Options:

A.

By using the searchtypes command in the search bar.

B.

By editing the event_type stanza in the props.conf file.

C.

By going to the Settings menu and clicking Event Types > New.

D.

By selecting an event in search results and clicking Event Actions > Build Event Type.

Buy Now
Questions 21

Which of the following are required to create a POST workflow action?

Options:

A.

Label, URI, search string.

B.

XMI attributes, URI, name.

C.

Label, URI, post arguments.

D.

URI, search string, time range picker.

Buy Now
Questions 22

Which group of users would most likely use pivots?

Options:

A.

Users

B.

Architects

C.

Administrators

D.

Knowledge Managers

Buy Now
Questions 23

Calculated fields can be based on which of the following?

Options:

A.

Tags

B.

Extracted fields

C.

Output fields for a lookup

D.

Fields generated from a search string

Buy Now
Questions 24

Selected fields are displayed ______each event in the search results.

Options:

A.

below

B.

interesting fields

C.

other fields

D.

above

Buy Now
Questions 25

Which of the following eval command function is valid?

Options:

A.

Int ()

B.

Count ( )

C.

Print ()

D.

Tostring ()

Buy Now
Questions 26

What are the two parts of a root event dataset?

Options:

A.

Fields and variables.

B.

Fields and attributes.

C.

Constraints and fields.

D.

Constraints and lookups.

Buy Now
Questions 27

Data model are composed of one or more of which of the following datasets? (select all that apply.)

Options:

A.

Events datasets

B.

Search datasets

C.

Transaction datasets

D.

Any child of event, transaction, and search datasets

Buy Now
Questions 28

Which of the following statements about event types is true? (select all that apply)

Options:

A.

Event types can be tagged.

B.

Event types must include a time range,

C.

Event types categorize events based on a search.

D.

Event types can be a useful method for capturing and sharing knowledge.

Buy Now
Questions 29

Which of the following statements describe the search string below?

| datamodel Application_State All_Application_State search

Options:

A.

Evenrches would return a report of sales by state.

B.

Events will be returned from the data model named Application_State.

C.

Events will be returned from the data model named All_Application_state.

D.

No events will be returned because the pipe should occur after the datamodel command

Buy Now
Questions 30

Which of the following statements describes Search workflow actions?

Options:

A.

By default. Search workflow actions will run as a real-time search.

B.

Search workflow actions can be configured as scheduled searches,

C.

The user can define the time range of the search when created the workflow action.

D.

Search workflow actions cannot be configured with a search string that includes the transaction command

Buy Now
Questions 31

What does the following search do?

Options:

A.

Creates a table of the total count of users and split by corndogs.

B.

Creates a table of the total count of mysterymeat corndogs split by user.

C.

Creates a table with the count of all types of corndogs eaten split by user.

D.

Creates a table that groups the total number of users by vegetarian corndogs.

Buy Now
Questions 32

Which of the following is NOT a stats function:

Options:

A.

sum

B.

addtotals

C.

count

D.

avg

Buy Now
Questions 33

Which of the following statements about tags is true?

Options:

A.

Tags are case insensitive.

B.

Tags are created at index time.

C.

Tags can make your data more understandable.

D.

Tags are searched by using the syntax tag: :

Buy Now
Questions 34

When creating a Search workflow action, which field is required?

Options:

A.

Search string

B.

Data model name

C.

Permission setting

D.

An eval statement

Buy Now
Questions 35

Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

Options:

A.

Alerts

B.

Email

C.

Database

D.

User permissions

Buy Now
Questions 36

Why would the following search produce multiple transactions instead of one?

Options:

A.

The maxspan option is not included.

B.

The transaction command has a limit of 1000 events per transaction.

C.

The transaction and commands cannot be used together.

D.

The stats list () function is used.

Buy Now
Questions 37

This function of the stats command allows you to return the sample standard deviation of a field.

Options:

A.

stdev

B.

dev

C.

count deviation

D.

by standarddev

Buy Now
Questions 38

The eval command allows you to do which of the following? (Choose all that apply.)

Options:

A.

Format values

B.

Convert values

C.

Perform calculations

D.

Use conditional statements

Buy Now
Questions 39

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Options:

A.

Access

B.

Accounting

C.

Authorization

D.

Authentication

Buy Now
Questions 40

Which field extraction method should be selected for comma-separated data?

Options:

A.

Regular expression

B.

Delimiters

C.

eval expression

D.

table extraction

Buy Now
Questions 41

For choropleth maps,splunk ships with the following KMZ files (select all that apply)

Options:

A.

States of the United States

B.

States and provinces of the united states and Canada

C.

Countries of the European Union

D.

Countries of the World

Buy Now
Questions 42

Which of the following search control will not re-rerun the search? (Select all that apply.)

Options:

A.

zoom out

B.

selecting a bar on the timeline

C.

deselect

D.

selecting a range of bars on the timelines

Buy Now
Questions 43

Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

Options:

A.

Field alias

B.

Event types

C.

Search workflow action

D.

Tags

Buy Now
Questions 44

How is a Search Workflow Action configured to run at the same time range as the original search?

Options:

A.

Set the earliest time to match the original search.

B.

Select the same time range from the time-range picker.

C.

Select the "Use the same time range as the search that created the field listing" checkbox.

D.

Select the "Overwrite time range with the original search" checkbox.

Buy Now
Questions 45

Select this in the fields sidebar to automatically pipe you search results to the rare command

Options:

A.

events with this field

B.

rare values

C.

top values by time

D.

top values

Buy Now
Questions 46

A user runs the following search:

index—X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother—f

Which of the following table headers match the order this command creates?

Options:

A.

The chart command does not allow for multiple statistical functions.

B.

Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase

C.

Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

D.

Count: product, sum: product, count: action, sum: action

Buy Now
Questions 47

What is a limitation of searches generated by workflow actions?

Options:

A.

Searches generated by workflow action cannot use macros.

B.

Searches generated by workflow actions must be less than 256 characters long.

C.

Searches generated by workflow action must run in the same app as the workflow action.

D.

Searches generated by workflow action run with the same permissions as the user running them.

Buy Now
Questions 48

The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?

Options:

A.

KV Store

B.

Lookups

C.

Saved searches

D.

Data models

Buy Now
Questions 49

Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Options:

A.

Fast

B.

Smart 

C.

C. Verbose

Buy Now
Questions 50

What is the Splunk Common Information Model (CIM)?

Options:

A.

The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.

B.

The CIM provides a methodology to normalize data from different sources and source types.

C.

The CIM defines an ecosystem of apps that can be fully supported by Splunk.

D.

The CIM is a data exchange initiative between software vendors.

Buy Now
Questions 51

What is the correct format for naming a macro with multiple arguments?

Options:

A.

monthly_sales(argument 1, argument 2, argument 3)

B.

monthly_sales(3)

C.

monthly_sales[3]

D.

monthly_sales[argument 1, argument 2, argument 3)

Buy Now
Questions 52

How can an existing accelerated data model be edited?

Options:

A.

An accelerated data model can be edited once its .tsidx file has expired.

B.

An accelerated data model can be edited from the Pivot tool.

C.

The data model must be de-accelerated before edits can be made to its structure.

D.

It cannot be edited. A new data model would need to be created.

Buy Now
Questions 53

Calculated fields can be based on which of the following?

Options:

A.

Tags

B.

Extracted fields

C.

Output fields for a lookup

D.

Fields generated from a search string

Buy Now
Questions 54

Which of the following is a function of the Splunk Common Information Model (CIM)?

Options:

A.

Normalizing data across a Splunk deployment.

B.

Providing templates for reports and dashboards.

C.

Algorithmically shifting events to other indexes.

D.

Reingesting previously indexed data with new field names.

Buy Now
Questions 55

What is the correct way to name a macro with two arguments?

Options:

A.

us_sales2

B.

us_sales(1,2)

C.

us_sale,2

D.

us_sales(2)

Buy Now
Questions 56

Use the dedup command to _____.

Options:

A.

Rename a field in the index

B.

remove duplicate values

C.

provide an additional alias for the field that can D.be used in the search criteria

Buy Now
Questions 57

Which of the following is a feature of the Pivot tool?

Options:

A.

Creates lookups without using SPL.

B.

Data Models are not required.

C.

Creates reports without using SPL

D.

Datasets are not required.

Buy Now
Questions 58

When creating a data model, which root dataset requires at least one constraint?

Options:

A.

Root transaction dataset

B.

Root event dataset

C.

Root child dataset

D.

Root search dataset

Buy Now
Questions 59

Which of the following is true about the Splunk Common Information Model (CIM)?

Options:

A.

The data models included in the CIM are configured with data model acceleration turned off.

B.

The CIM contains 28 pre-configured datasets.

C.

The CIM is an app that needs to run on the indexer.

D.

The data models included in the CIM are configured with data model acceleration turned on.

Buy Now
Questions 60

Consider the the following search run over a time range of last 7 days:

index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane

Which option is used to change the default time span so that results are grouped into 12 hour intervals?

Options:

A.

span=12h

B.

timespan=12h

C.

span=12

D.

timespan=12

Buy Now
Questions 61

Consider the following search:

index=web sourcetype=access_combined

The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group.

From the following list, which search groups events by JSESSIONID?

Options:

A.

index=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117

B.

index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117

C.

index=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID

D.

index=web sourcetype=access_combined JSESSIONID

Buy Now
Questions 62

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Options:

A.

There is a limit to the number of fields that can be extracted.

B.

The user is unable to preview the extractions.

C.

The extraction is added at index time.

D.

The user is unable to return to the automatic field extraction workflow.

Buy Now
Questions 63

When a search returns __________, you can view the results as a list.

Options:

A.

a list of events

B.

transactions

C.

statistical values

Buy Now
Questions 64

Which of the following is true about data model attributes?

Options:

A.

They cannot be created within the data model.

B.

They can only be added into a root search dataset.

C.

They cannot be edited if inherited from a parent dataset.

D.

They can be added to a dataset from search time field extractions.

Buy Now
Questions 65

Which of the following statements describes calculated fields?

Options:

A.

Calculated fields are only used on fields added by lookups.

B.

Calculated fields are a shortcut for repetitive and complex eval commands.

C.

Calculated fields are a shortcut for repetitive and complex calc commands.

D.

Calculated fields automatically calculate the simple moving average for indexed fields.

Buy Now
Questions 66

Which of the following searches will return events containing a tag named Privileged?

Options:

A.

tag=Priv

B.

tag=Priv*

C.

tag=priv*

D.

tag=privileged

Buy Now
Questions 67

When can a pipe follow a macro?

Options:

A.

A pipe may always follow a macro.

B.

The current user must own the macro.

C.

The macro must be defined in the current app.

D.

Only when sharing is set to global for the macro.

Buy Now
Questions 68

Which of the following data models are included in the Splunk Common Information Model (CIM) add-on? (select all that apply)

Options:

A.

User permissions

B.

Alerts

C.

Databases

D.

Email

Buy Now
Questions 69

When using | timchart by host, which filed is representted in the x-axis?

Options:

A.

date

B.

host

C.

time

D.

-time

Buy Now
Questions 70

Consider the following search:

index=web sourcetype=access_corabined

The log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a group.

From the following list, which search groups events by jSSESSIONID?

Options:

A.

index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267

B.

index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID

C.

index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267

D.

index=web sourcetype=access_combined JSESSTONID

Buy Now
Questions 71

The macro weekly_sales (2) contains the search string:

index=games | eval ProductSales = $Price$ * $AmountSold$

Which of the following will return results?

Options:

A.

‘weekly sales (3)’

B.

‘weekly_sales($3.995, $108)’

C.

'weekly_sales (3.99, 10)’

D.

‘weekly sales (3.99, 10)’

Buy Now
Questions 72

When would transaction be used instead of stats?

Options:

A.

To group events based on a single field value.

B.

To see results of a calculation.

C.

To have a faster and more efficient search.

D.

To group events based on start/end values.

Buy Now
Questions 73

When using timechart, how many fields can be listed after a by clause?

Options:

A.

because timechart doesn't support using a by clause.

B.

because _time is already implied as the x-axis.

C.

because one field would represent the x-axis and the other would represent the y-axis.

D.

There is no limit specific to timechart.

Buy Now
Questions 74

After manually editing; a regular expression (regex), which of the following statements is true?

Options:

A.

Changes made manually can be reverted in the Field Extractor (FX) UI.

B.

It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

C.

It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.

D.

The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

Buy Now
Questions 75

In which of the following scenarios is an event type more effective than a saved search?

Options:

A.

When a search should always include the same time range.

B.

When a search needs to be added to other users' dashboards.

C.

When the search string needs to be used in future searches.

D.

When formatting needs to be included with the search string.

Buy Now
Exam Code: SPLK-1002
Exam Name: Splunk Core Certified Power User Exam
Last Update: Mar 23, 2024
Questions: 252
$64  $159.99
$48  $119.99
$40  $99.99
buy now SPLK-1002