Splunk SPLK-1002 - Splunk Core Certified Power User Exam
Page: 3 / 47
Total 234 questions
Question #11 (Topic: Single Topic)
By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?
A. Turned off.
B. Turned on.
C. Determined automatically based on the sourcetype.
D. Determined automatically based on the data source.
Answer: A
Question #12 (Topic: Single Topic)
Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)
A. CIM is a methodology for normalizing data.
B. CIM can correlate data from different sources.
C. The Knowledge Manager uses the CIM to create knowledge objects.
D. CIM is an app that can coexist with other apps on a single Splunk deployment.
Answer: ABC
Question #13 (Topic: Single Topic)
Which of the following knowledge objects represents the output of an eval expression?
A. Eval fields
B. Calculated fields
C. Field extractions
D. Calculated lookups
Answer: B
Question #14 (Topic: Single Topic)
What do events in a transaction have in common?
A. All events in a transaction must have the same timestamp.
B. All events in a transaction must have the same sourcetype.
C. All events in a transaction must have the exact same set of fields.
D. All events in a transaction must be related by one or more fields.
Answer: D
Question #15 (Topic: Single Topic)
Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)
A. Tabs
B. Pipes
C. Spaces
D. Commas
Answer: ABC
