Splunk Core Certified Power User v1.0 (SPLK-1002)

Page:    1 / 9   
Total 133 questions

Which of the following statements describes the use of the Field Extractor (FX)?

  • A. The Field Extractor automatically extracts all fields at search time.
  • B. The Field Extractor uses PERL to extract fields from the raw events.
  • C. Fields extracted using the Field Extractor persist as knowledge objects.
  • D. Fields extracted using the Field Extractor do not persist and must be defined for each search.


Answer : C

Which of the following searches would return a report of sales by product_name?

  • A. chart sales by product_name
  • B. chart sum(price) as sales by product_name
  • C. stats sum(price) as sales over product_name
  • D. timechart list(sales), values(product_name)


Answer : C

Reference:
http://hilllaneconsulting.co.uk/blog/?p=640

Which of the following data models are included in the Splunk Common Information Model (CIM) add-on? (Choose all that apply.)

  • A. Alerts
  • B. Email
  • C. Databases
  • D. User permissions


Answer : ABC

Reference:
https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview

What is a limitation of searches generated by workflow actions?

  • A. Searches generated by workflow actions cannot use macros.
  • B. Searches generated by workflow actions must be less than 256 characters long.
  • C. Searches generated by workflow actions must run in the same app as the workflow action.
  • D. Searches generated by workflow actions run with the same permissions as the user running them.


Answer : D

Which of the following searches would create a graph similar to the one below?

  • A. index=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | stats count by status
  • B. index=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | chart count OVER status by _time
  • C. index=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status
  • D. None of these searches would generate a similar graph.


Answer : D

None of these functions related to the graph in exhibit. All of these functions have maxspan=ld which is not a valid argument.

What does the transaction command do?

  • A. Groups a set of transactions based on time.
  • B. Creates a single event from a group of events.
  • C. Separates two events based on one or more values.
  • D. Returns the number of credit card transactions found in the event logs.


Answer : B

What is the relationship between data models and pivots?

  • A. Data models provide the datasets for pivots.
  • B. Pivots and data models have no relationship.
  • C. Pivots and data models are the same thing.
  • D. Pivots provide the datasets for data models.


Answer : A

Which of the following statements describes Search workflow actions?

  • A. By default, Search workflow actions will run as a real-time search.
  • B. Search workflow actions can be configured as scheduled searches.
  • C. The user can define the time range of the search when created the workflow action.
  • D. Search workflow actions cannot be configured with a search string that includes the transaction command.


Answer : C

Which of the following commands support the same set of functions?

  • A. stats, eval, table
  • B. search, where, eval
  • C. stats, chart, timechart
  • D. transaction, chart, timechart


Answer : C

The eval command allows you to do which of the following? (Choose all that apply.)

  • A. Format values
  • B. Convert values
  • C. Perform calculations
  • D. Use conditional statements


Answer : ABCD

When using the timechart command, how can a user group the events into buckets based on time?

  • A. Using the span argument.
  • B. Using the duration argument.
  • C. Using the interval argument.
  • D. Adjusting the fieldformat options.


Answer : A

Which of the following statements about data models and pivot are true? (Choose all that apply.)

  • A. They are both knowledge objects.
  • B. Data models are created out of datasets called pivots.
  • C. Pivot requires users to input SPL searches on data models.
  • D. Pivot allows the creation of data visualizations that present different aspects of a data model.


Answer : BD

Data model fields can be added using the Auto-Extracted method.
Which of the following statements describe Auto-Extracted fields? (Choose all that apply.)

  • A. Auto-Extracted fields can be hidden in Pivot.
  • B. Auto-Extracted fields can have their data type changed.
  • C. Auto-Extracted fields can be given a friendly name for use in Pivot.
  • D. Auto-Extracted fields can be added if they already exist in the dataset with constraints.


Answer : B

Which type of visualization shows relationships between discrete values in three dimensions?

  • A. Pie chart
  • B. Line chart
  • C. Bubble chart
  • D. Scatter chart


Answer : D

Which of the following is a function of the Splunk Common Information Model (CIM)?

  • A. Normalizing data across a Splunk deployment.
  • B. Providing templates for reports and dashboards.
  • C. Algorithmically shifting events to other indexes.
  • D. Reingesting previously indexed data with new field names.


Answer : A

Reference:
https://docs.splunk.com/Documentation/CIM/4.18.0/User/Overview

Page:    1 / 9   
Total 133 questions