Free Access To Splunk Core Certified Power User SPLK-1002 Dumps

test2022-08-16T06:47:03+00:00

By test SPLK-1002 Dumps, SPLK-1002 practice exam, SPLK-1002 questions and answers, Splunk Core Certified Power User 0 Comments

To pass the SPLK-1002 Splunk Core Certified Power User exam, you’ll need to download the most recent SPLK-1002 Dumps, which will help you pass the test without difficulty. The latest updated SPLK-1002 Dumps help you know about the exam layout and topics. You can practice the actual test questions in the SPLK-1002 section online first. FreeTestShare Splunk Core Certified Power User SPLK-1002 Dumps cover latest exam questions and answers to help you pass your Splunk SPLK-1002 exam easily!

Try Free SPLK-1002 Practice Exam to Test Yourself

Page 1 of 5

1. Which of the following statements would help a user choose between the transaction and stats commands?

state can only group events using IP addresses.

The transaction command is faster and more efficient.

There is a 1000 event limitation with the transaction command.

Use state when the events need to be viewed as a single event.

2. Which of the following searches show a valid use of a macro? (Choose all that apply.)

index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField

index=main source=mySource oldField=* | stats if(‘makeMyField(oldField)’) | table _time newField

index=main source=mySource oldField=* | eval newField=’makeMyField(oldField)’| table _time newField

index=main source=mySource oldField=* | "’newField(‘makeMyField(oldField)’)’" | table _time newField

3. When can a pipe follow a macro?

A pipe may always follow a macro.

The current user must own the macro.

The macro must be defined in the current app.

Only when sharing is set to global for the macro.

4. Which of the following commands will show the maximum bytes?

sourcetype=access_* | maximum totals by bytes

sourcetype=access_* | avg (bytes)

sourcetype=access_* | stats max(bytes)

sourcetype=access_* | max(bytes)

5. Data model are composed of one or more of which of the following datasets? (select all that apply.)

Events datasets

Search datasets

Transaction datasets

Any child of event, transaction, and search datasets

6. Which of these is NOT a field that is automatically created with the transaction command?

maxcount

duration

eventcount

7. Which of the following statements describes the use of the Filed Extractor (FX)?

The Field Extractor automatically extracts all field at search time.

The Field Extractor uses PERL to extract field from the raw events.

Field extracted using the Extracted persist as knowledge objects.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

8. Alert throttling is used to _______.

verify each alert

stagger search request in a time sequenced order

stop spamming yourself with alerts

check severity

9. Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

inputlookup

lookup

10. This tab shows you the event patterns in the results of a specific search.

statistics

visualization

patterns

Page 2 of 5

11. The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization.

If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

Fast mode is enabled.

The dashboard is private.

The extraction is private-

The person in the organization running the report does not have access to the index.

12. If a search returns ____________ it can be viewed as a chart.

timestamps

statistics

events

keywords

13. Which of the following is NOT a stats function:

sum

addtotals

count

avg

14. What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Macros.

Field aliases.

The rename command.

CIM does not work with different names for the same field.

15. Which of the following statements describes field aliases?

Field alias names replace the original field name.

Field aliases can be used in lookup file definitions.

Field aliases only normalize data across sources and sourcetypes.

Field alias names are not case sensitive when used as part of a search.

16. The stats command will create a _____________ by default.

Table

Report

Pie chart

17. Which of the following actions can the eval command perform?

Remove fields from results.

Create or replace an existing field.

Group transactions by one or more fields.

Save SPL commands to be reused in other searches.

18. Which of the following can be used with the eval command tostring function (select all that apply)

‘’hex’’

‘’commas’’

‘’Decimal’’

‘’duration’’

19. For choropleth maps,splunk ships with the following KMZ files (select all that apply)

States of the United States

States and provinces of the united states and Canada

Countries of the European Union

Countries of the World

20. Which of the following statements are true for this search? (Select all that apply.) SEARCH:

sourcetype=access* |fields action productld status

is looking for all events that include the search terms: fields AND action AND productld AND status

users the table command to improve performance

limits the fields are extracted

returns a table with 3 columns

Page 3 of 5

21. A user wants to create a new field alias for a field that appears in two sourcetypes.

How many field aliases need to be created?

One.

Two.

It depends on whether the original fields have the same name.

It depends on whether the two sourcetypes are associated with the same index.

22. The timechart command buckets data in time intervals depending on:

the number of events returned

the selected time range

the type of visualization selected

23. How many ways are there to access the Field Extractor Utility?

24. When extracting fields, we may choose to use our own regular expressions

True

False

25. Highlighted search terms indicate _________ search results in Splunk.

Display as selected fields.

Sorted

Charted based on time

Matching

26. Which of the following statements describes Search workflow actions?

By default. Search workflow actions will run as a real-time search.

Search workflow actions can be configured as scheduled searches,

The user can define the time range of the search when created the workflow action.

Search workflow actions cannot be configured with a search string that includes the transaction command

27. A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

skipped or deferred

automatically accelerated

deleted

all of the above

28. Which of the following statements describes calculated fields?

Calculated fields are only used on fields added by lookups.

Calculated fields are a shortcut for repetitive and complex eval commands.

Calculated fields are a shortcut for repetitive and complex calc commands.

Calculated fields automatically calculate the simple moving average for indexed fields.

29. The eval command 'if' function requires the following three arguments (in order):

Boolean expression, result if true, result if false

Result if true, result if false, boolean expression

Result if false, result if true, boolean expression

Boolean expression, result if false, result if true

30. Which of the following is a function of the Splunk Common Information Model (CIM)?

Normalizing data across a Splunk deployment.

Providing templates for reports and dashboards.

Algorithmically shifting events to other indexes.

Reingesting previously indexed data with new field names.

Page 4 of 5

31. When you mouse over and click to add a search term this (these. Boolean operator(s) is (are. not implied. (Select all that apply).

( )

AND

NOT

32. By default search results are not returned in ________ order.

Chronological

Reverser chronological

ASCIE

Alphabetical

33. Which group of users would most likely use pivots?

Users

Architects

Administrators

Knowledge Managers

34. When is a GET workflow action needed?

To send field values to an external resource.

To retrieve information from an external resource.

To use field values to perform a secondary search.

To define how events flow from forwarders to indexes.

35. Field aliases are used to __________ data

clean

transform

calculate

normalize

36. These users can create global knowledge objects. (Select all that apply.)

users

power users

administrators

37. The eval command allows you to do which of the following? (Choose all that apply.)

Format values

Convert values

Perform calculations

Use conditional statements

38. What do events in a transaction have In common?

All events In a transaction must have the same timestamp.

All events in a transaction must have the same sourcetype.

All events in a transaction must have the exact same set of fields.

All events in a transaction must be related by one or more fields.

39. The transaction command allows you to __________ events across multiple sources

duplicate

correlate

persist

tag

40. The gauge command:

creates a single-value visualization

allows you to set colored ranges for a single-value visualization

creates a radial gauge visualization

Page 5 of 5

41. Which search would limit an "alert" tag to the "host" field?

tag=alert

host::tag::alert

tag==alert

tag::host=alert

42. In the Field Extractor Utility, this button will display events that do not contain extracted fields.

Select your answer.

Selected-Fields

Non-Matches

Non-Extractions

Matches

43. We can use the rename command to _____ (Select all that apply.)

Change indexed fields

Exclude fields from our search results

Extract new fields from our data using regular expressions

Give a field a new name at search time

44. What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

There is a limit to the number of fields that can be extracted.

The user is unable to preview the extractions.

The extraction is added at index time.

The user is unable to return to the automatic field extraction workflow.

45. In which of the following scenarios is an event type more effective than a saved search?

When a search should always include the same time range.

When a search needs to be added to other users' dashboards.

When the search string needs to be used in future searches.

When formatting needs to be included with the search string.

46. Which of the following statements describe calculated fields? (select all that apply)

Calculated fields can be used in the search bar.

Calculated fields can be based on an extracted field.

Calculated fields can only be applied to host and sourcetype.

Calculated fields are shortcuts for performing calculations using the eval command.