March Sale Special - 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: c4sdisc65

SPLK-1002 PDF

$38.5

$109.99

3 Months Free Update

  • Printable Format
  • Value of Money
  • 100% Pass Assurance
  • Verified Answers
  • Researched by Industry Experts
  • Based on Real Exams Scenarios
  • 100% Real Questions

SPLK-1002 PDF + Testing Engine

$61.6

$175.99

3 Months Free Update

  • Exam Name: Splunk Core Certified Power User Exam
  • Last Update: Mar 4, 2024
  • Questions and Answers: 248
  • Free Real Questions Demo
  • Recommended by Industry Experts
  • Best Economical Package
  • Immediate Access

SPLK-1002 Engine

$46.2

$131.99

3 Months Free Update

  • Best Testing Engine
  • One Click installation
  • Recommended by Teachers
  • Easy to use
  • 3 Modes of Learning
  • State of Art Technology
  • 100% Real Questions included

SPLK-1002 Splunk Core Certified Power User Exam Questions and Answers

Question # 6

How is an event type created from the search window? (select all that apply)

A.

In the top right corner, click Save As > Event Type.

B.

In an event's detail dropdown, click Event Actions > Build Event Type.

C.

Edit eventtypes.conf and add a new stanza.

D.

Add | eventtype to the SPL and execute the search.

Full Access
Question # 7

Using the export function, you can export search results as __________.( Select all that apply)

A.

Xml

B.

Json

C.

Html

D.

A php file

Full Access
Question # 8

Which of the following statements about tags is true?

A.

Tags are case insensitive.

B.

Tags can make your data more understandable.

C.

Tags are created at index time.

D.

Tags are searched by using the syntax tag :: .

Full Access
Question # 9

Which of the following is true about data model attributes?

A.

They cannot be created within the data model.

B.

They can only be added into a root search dataset.

C.

They cannot be edited if inherited from a parent dataset.

D.

They can be added to a dataset from search time field extractions.

Full Access
Question # 10

The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?

A.

KV Store

B.

Lookups

C.

Saved searches

D.

Data models

Full Access
Question # 11

A calculated field is a shortcut for performing repetitive, long, or complex transformations using which of the following commands?

A.

transaction

B.

lookup

C.

stats

D.

eval

Full Access
Question # 12

The time range specified for a historical search defines the ____________ .------questionable on ans

A.

Amount of data shown on the timeline as data streams in

B.

Amount of data fetched from index matching that time range

C.

Time range for the static results

Full Access
Question # 13

Which of the following statements would help a user choose between the transaction and stats commands?

A.

state can only group events using IP addresses.

B.

The transaction command is faster and more efficient.

C.

There is a 1000 event limitation with the transaction command.

D.

Use state when the events need to be viewed as a single event.

Full Access
Question # 14

Which of the following are required to create a POST workflow action?

A.

Label, URI, search string.

B.

XMI attributes, URI, name.

C.

Label, URI, post arguments.

D.

URI, search string, time range picker.

Full Access
Question # 15

Which of the following searches show a valid use of macro? (Select all that apply)

A.

index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

B.

index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField

C.

index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

D.

index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

Full Access
Question # 16

How does a user display a chart in stack mode?

A.

By using the stack command.

B.

By turning on the Use Trellis Layout option.

C.

By changing Stack Mode in the Format menu.

D.

You cannot display a chart in stack mode, only a timechart.

Full Access
Question # 17

Selected fields are displayed ______each event in the search results.

A.

below

B.

interesting fields

C.

other fields

D.

above

Full Access
Question # 18

In which of the following scenarios is an event type more effective than a saved search?

A.

When a search should always include the same time range.

B.

When a search needs to be added to other users' dashboards.

C.

When the search string needs to be used in future searches.

D.

When formatting needs to be included with the search string.

Full Access
Question # 19

Which of the following statements describes macros?

A.

A macro is a reusable search string that must contain the full search.

B.

A macro is a reusable search string that must have a fixed time range.

C.

A macro Is a reusable search string that may have a flexible time range.

D.

A macro Is a reusable search string that must contain only a portion of the search.

Full Access
Question # 20

Which of the following searches will return events contains a tag name Privileged?

A.

Tag= Priv

B.

Tag= Pri*

C.

Tag= Priv*

D.

Tag= Privileged

Full Access
Question # 21

Which of the following statements describes the command below (select all that apply)

Sourcetype=access_combined | transaction JSESSIONID

A.

An additional filed named maxspan is created.

B.

An additional field named duration is created.

C.

An additional field named eventcount is created.

D.

Events with the same JSESSIONID will be grouped together into a single event.

Full Access
Question # 22

What are the two parts of a root event dataset?

A.

Fields and variables.

B.

Fields and attributes.

C.

Constraints and fields.

D.

Constraints and lookups.

Full Access
Question # 23

Which are valid ways to create an event type? (select all that apply)

A.

By using the searchtypes command in the search bar.

B.

By editing the event_type stanza in the props.conf file.

C.

By going to the Settings menu and clicking Event Types > New.

D.

By selecting an event in search results and clicking Event Actions > Build Event Type.

Full Access
Question # 24

Which of the following statements describes POST workflow actions?

A.

POST workflow actions are always encrypted.

B.

POST workflow actions cannot use field values in their URI.

C.

POST workflow actions cannot be created on custom sourcetypes.

D.

POST workflow actions can open a web page in either the same window or a new .

Full Access
Question # 25

Which of the following statements describe the search below? (select all that apply)

Index=main I transaction clientip host maxspan=30s maxpause=5s

A.

Events in the transaction occurred within 5 seconds.

B.

It groups events that share the same clientip and host.

C.

The first and last events are no more than 5 seconds apart.

D.

The first and last events are no more than 30 seconds apart.

Full Access
Question # 26

Which of the following statements describes Search workflow actions?

A.

By default. Search workflow actions will run as a real-time search.

B.

Search workflow actions can be configured as scheduled searches,

C.

The user can define the time range of the search when created the workflow action.

D.

Search workflow actions cannot be configured with a search string that includes the transaction command

Full Access
Question # 27

When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

A.

Tabs

B.

Pipes

C.

Colons

D.

Spaces

Full Access
Question # 28

Which of the following workflow actions can be executed from search results? (select all that apply)

A.

GET

B.

POST

C.

LOOKUP

D.

Search

Full Access
Question # 29

Which of the following statements describe data model acceleration? (select all that apply)

A.

Root events cannot be accelerated.

B.

Accelerated data models cannot be edited.

C.

Private data models cannot be accelerated.

D.

You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.

Full Access
Question # 30

Which of the following statements is true, especially in large environments?

A.

Use the scats command when you next to group events by two or more fields.

B.

The stats command is faster and more efficient than the transaction command

C.

The transaction command is faster and more efficient than the stats command.

D.

Use the transaction command when you want to see the results of a calculation.

Full Access
Question # 31

Which of the following eval command function is valid?

A.

Int ()

B.

Count ( )

C.

Print ()

D.

Tostring ()

Full Access
Question # 32

Which of the following searches will return all clientip addresses that start with 108?

A.

… | where like (clientip, “108.% )

B.

… | where (clientip, "108. %")

C.

… | where (clientip=108. % )

D.

… | search clientip=108

Full Access
Question # 33

Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

A.

| datamodel web search | filed web *

B.

| Search datamodel web web | filed web*

C.

| datamodel web web field | search web*

D.

Datamodel=web | search web | filed web*

Full Access
Question # 34

Which of the following actions can the eval command perform?

A.

Remove fields from results.

B.

Create or replace an existing field.

C.

Group transactions by one or more fields.

D.

Save SPL commands to be reused in other searches.

Full Access
Question # 35

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

A.

The regex can no longer be edited.

B.

The field being extracted will be required for all future events.

C.

The events without the required field will not display in searches.

D.

Only events with the required string will be included in the extraction.

Full Access
Question # 36

What is the correct syntax to search for a tag associated with a value on a specific fields?

A.

Tag-

B.

Tag

C.

Tag=::

D.

Tag::=

Full Access
Question # 37

Which one of the following statements about the search command is true?

A.

It does not allow the use of wildcards.

B.

It treats field values in a case-sensitive manner.

C.

It can only be used at the beginning of the search pipeline.

D.

It behaves exactly like search strings before the first pipe.

Full Access
Question # 38

Which of the following knowledge objects represents the output of an eval expression?

A.

Eval fields

B.

Calculated fields

C.

Field extractions

D.

Calculated lookups

Full Access
Question # 39

Which of the following statements describe the search string below?

| datamodel Application_State All_Application_State search

A.

Evenrches would return a report of sales by state.

B.

Events will be returned from the data model named Application_State.

C.

Events will be returned from the data model named All_Application_state.

D.

No events will be returned because the pipe should occur after the datamodel command

Full Access
Question # 40

When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

A.

Rank

B.

Weight

C.

Priority

D.

Precedence

Full Access
Question # 41

Which group of users would most likely use pivots?

A.

Users

B.

Architects

C.

Administrators

D.

Knowledge Managers

Full Access
Question # 42

Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

A.

CIM is a methodology for normalizing data.

B.

CIM can correlate data from different sources.

C.

The Knowledge Manager uses the CIM to create knowledge objects.

D.

CIM is an app that can coexist with other apps on a single Splunk deployment.

Full Access
Question # 43

Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

SPLK-1002 question answer

A.

The macro name issessiontrackerand the arguments areaction, JESSIONID.

B.

The macro name issessiontracker(2)and the arguments areaction, JESSIONID.

C.

The macro name issessiontrackerand the arguments are$action$, $JESSIONID$.

D.

The macro name issessiontracker(2)and the Arguments are$action$, $JESSIONID$.

Full Access
Question # 44

What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

A.

Custom visualizations

B.

Pre-configured data models

C.

Fields and event category tags

D.

Automatic data model acceleration

Full Access
Question # 45

What is the relationship between data models and pivots?

A.

Data models provide the datasets for pivots.

B.

Pivots and data models have no relationship.

C.

Pivots and data models are the same thing.

D.

Pivots provide the datasets for data models.

Full Access
Question # 46

What does the transaction command do?

A.

Groups a set of transactions based on time.

B.

Creates a single event from a group of events.

C.

Separates two events based on one or more values.

D.

Returns the number of credit card transactions found in the event logs.

Full Access
Question # 47

Which of the following Statements about macros is true? (select all that apply)

A.

Arguments are defined at execution time.

B.

Arguments are defined when the macro is created.

C.

Argument values are used to resolve the search string at execution time.

D.

Argument values are used to resolve the search string when the macro is created.

Full Access
Question # 48

Which of the following statements describe calculated fields? (select all that apply)

A.

Calculated fields can be used in the search bar.

B.

Calculated fields can be based on an extracted field.

C.

Calculated fields can only be applied to host and sourcetype.

D.

Calculated fields are shortcuts for performing calculations using the eval command.

Full Access
Question # 49

Which of the following file formats can be extracted using a delimiter field extraction?

A.

CSV

B.

PDF

C.

XML

D.

JSON

Full Access
Question # 50

Which of the following describes the Splunk Common Information Model (CIM) add-on?

A.

The CIM add-on uses machine learning to normalize data.

B.

The CIM add-on contains dashboards that show how to map data.

C.

The CIM add-on contains data models to help you normalize data.

D.

The CIM add-on is automatically installed in a Splunk environment.

Full Access
Question # 51

A user runs the following search:

index—X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother—f

Which of the following table headers match the order this command creates?

A.

The chart command does not allow for multiple statistical functions.

B.

Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase

C.

Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

D.

Count: product, sum: product, count: action, sum: action

Full Access
Question # 52

Which syntax is used to represent an argument in a macro definition?

A.

"argument"

B.

%argument%

C.

‘argument’

D.

$argument$

Full Access
Question # 53

Select this in the fields sidebar to automatically pipe you search results to the rare command

A.

events with this field

B.

rare values

C.

top values by time

D.

top values

Full Access
Question # 54

What fields does the transaction command add to the raw events? (select all that apply)

A.

count

B.

duration

C.

eventcount

D.

transaction id

Full Access
Question # 55

When would transaction be used instead of stats?

A.

To group events based on a single field value.

B.

To see results of a calculation.

C.

To have a faster and more efficient search.

D.

To group events based on start/end values.

Full Access
Question # 56

Why are tags useful in Splunk?

A.

Tags look for less specific data.

B.

Tags visualize data with graphs and charts.

C.

Tags group related data together.

D.

Tags add fields to the raw event data.

Full Access
Question # 57

If a search returns ____________ it can be viewed as a chart.

A.

timestamps

B.

statistics

C.

events

D.

keywords

Full Access
Question # 58

What are the expected results for a search that contains the command | where A=B?

A.

Events that contain the string value where A=B.

B.

Events that contain the string value A=B.

C.

Events where values of field are equal to values of field B.

D.

Events where field A contains the string value B.

Full Access
Question # 59

Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

A.

Field alias

B.

Event types

C.

Search workflow action

D.

Tags

Full Access
Question # 60

This clause is used to group the output of a stats command by a specific name.

A.

Rex

B.

As

C.

List

D.

By

Full Access
Question # 61

When using| timechart by host, which field is represented in the x-axis?

A.

date

B.

host

C.

time

D.

_time

Full Access
Question # 62

Which search string would only return results for an event type called success ful_purchases?

A.

tag=success ful_purchases

B.

Event Type:: successful purchases

C.

successful_purchases

D.

event type—success ful_purchases

Full Access
Question # 63

A data model can consist of what three types of datasets?

A.

Pivot, searches, and events.

B.

Pivot, events, and transactions.

C.

Searches, transactions, and pivot.

D.

Events, searches, and transactions.

Full Access
Question # 64

How is a Search Workflow Action configured to run at the same time range as the original search?

A.

Set the earliest time to match the original search.

B.

Select the same time range from the time-range picker.

C.

Select the "Use the same time range as the search that created the field listing" checkbox.

D.

Select the "Overwrite time range with the original search" checkbox.

Full Access
Question # 65

When extracting fields, we may choose to use our own regular expressions

A.

True

B.

False

Full Access
Question # 66

Which of the following statements describes calculated fields?

A.

Calculated fields are only used on fields added by lookups.

B.

Calculated fields are a shortcut for repetitive and complex eval commands.

C.

Calculated fields are a shortcut for repetitive and complex calc commands.

D.

Calculated fields automatically calculate the simple moving average for indexed fields.

Full Access
Question # 67

Which of the following statements describes POST workflow actions?

A.

Configuration of a POST workflow action includes choosing a sourcetype.

B.

POST workflow actions can be configured to send email to the URI location.

C.

By default, POST workflow action are shown in both the event and field menus.

D.

POST workflow actions can be configured to send POST arguments to the URI location.

Full Access
Question # 68

When defining a macro, what are the required elements?

A.

Name and arguments.

B.

Name and a validation error message.

C.

Name and definition.

D.

Definition and arguments.

Full Access
Question # 69

Which of the following about reports is/are true?

A.

Reports are knowledge objects.

B.

Reports can be scheduled.

C.

Reports can run a script.

D.

All of the above.

Full Access
Question # 70

By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

A.

Turned off

B.

Turned on

C.

Determined automatically based on the sourcetype.

D.

Determined automatically based on the data source.

Full Access
Question # 71

When can a pipe follow a macro?

A.

A pipe may always follow a macro.

B.

The current user must own the macro.

C.

The macro must be defined in the current app.

D.

Only when sharing is set to global for the macro.

Full Access
Question # 72

Field aliases are used to __________ data

A.

clean

B.

transform

C.

calculate

D.

normalize

Full Access
Question # 73

Consider the the following search run over a time range of last 7 days:

index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane

Which option is used to change the default time span so that results are grouped into 12 hour intervals?

A.

span=12h

B.

timespan=12h

C.

span=12

D.

timespan=12

Full Access
Question # 74

Given the following eval statement:

...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull, "NO-VALUE", fieid2)

Which of the following is the equivalent using f ilinull?

A.

There is no equivalent expression using f ilinull

B.

... t filinull values=(0,"NO-VALUE") fields=(fieldl,field2)

C.

... I filinull value=0 fieldl I fillnull fields

D.

... I fillnull fieldl I filinull value="NO-VALUE" field2

Full Access