Splunk SPLK-1004 - Splunk Core Certified Advanced Power User Exam
Page: 3 / 19
Total 95 questions
Question #11 (Topic: Exam A)
What qualifies a report for acceleration?
A. Fewer than 100k events in search results, with transforming commands used in the search string.
B. More than 100k events in search results, with only a search command in the search string.
C. More than 100k events in the search results, with a search and transforming command used in the search string.
D. Fewer than 100k events in search results, with only a search and transaction command used in the search string.
Answer: C
Question #12 (Topic: Exam A)
What happens to panels with post-processing searches when their base search is refreshed?
A. The panels are deleted.
B. The panels are only refreshed if they have also been configured.
C. The panels are refreshed automatically.
D. Nothing happens to the panels.
Answer: C
Question #13 (Topic: Exam A)
How is a cascading input used?
A. As part of a dashboard, but not in a form.
B. Without token notation in the underlying XML.
C. As a way to filter other input selections.
D. As a default way to delete a user role.
Answer: C
Question #14 (Topic: Exam A)
Which commands can run on both search heads and indexers?
A. Transforming commands
B. Centralized streaming commands
C. Dataset processing commands
D. Distributable streaming commands
Answer: D
Question #15 (Topic: Exam A)
If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?
A. Double tick marks around the nested macro.
B. A comma before the nested macro.
C. Square brackets around the nested macro.
D. A pipe character before the nested macro.
Answer: D
