Updated Oct-2021 Test Engine or PDF for the Splunk SPLK-1002 test to help you quickly prepare for the Splunk exam!
Full SPLK-1002 Practice Test and 179 unique questions with explanations waiting just for you, get it now!
NEW QUESTION 77
When extracting fields, we may choose to use our own regular expressions
- A. True
- B. False
Answer: A
NEW QUESTION 78
The interesting fields in the fields sidebar is based on what fields you have requested in the past.
- A. False
- B. True
Answer: A
NEW QUESTION 79
Which of these is NOT a field that is automatically created with the transaction command?
- A. maxcount
- B. duration
- C. eventcount
Answer: A
NEW QUESTION 80
A data model consists of which three types of datasets?
- A. Transaction, session ID, metadata.
- B. Events, searches, transactions.
- C. Field extraction, regex, delimited.
- D. Constraint, field, value.
Answer: B
Explanation:
Explanation
The building block of a data model. Each data model is composed of one or more data model datasets. Each dataset within a data model defines a subset of the dataset represented by the data model as a whole.
Data model datasets have a hierarchical relationship with each other, meaning they have parent-child relationships. Data models can contain multiple dataset hierarchies. There are three types of dataset hierarchies: event, search, and transaction.
https://docs.splunk.com/Splexicon:Datamodeldataset
NEW QUESTION 81
Which of the following searches will return events contains a tag name Privileged?
- A. Tag= Priv
- B. Tag= Pri*
- C. Tag= Privileged
- D. Tag= Priv*
Answer: B
NEW QUESTION 82
Which of the following searches would create a graph similar to the one below?
index=_internal sourcetype=SavedSplunker | fields sourcetype, status |
- A. transaction status maxspan=1d | timechart count by status
- B. transaction status maxspan=1d | stats count by status
index=_internal sourcetype=SavedSplunker | fields sourcetype, status | - C. None of these searches would generate a similar graph.
- D. transaction status maxspan=1d | chart count OVER status by _time
index=_internal sourcetype=SavedSplunker | fields sourcetype, status |
Answer: C
Explanation:
None of these functions related to the graph in exhibit. All of these functions have maxspan=ld which is not a valid argument.
NEW QUESTION 83
Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)
- A. Spaces
- B. Tabs
- C. Pipes
- D. Commas
Answer: A,C,D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep
NEW QUESTION 84
Which of the following statements describes field aliases?
- A. Field aliases can be used in lookup file definitions.
- B. Field alias names replace the original field name.
- C. Field aliases only normalize data across sources and sourcetypes.
- D. Field alias names are not case sensitive when used as part of a search.
Answer: B
NEW QUESTION 85
Which workflow uses field values to perform a secondary search?
- A. Action
- B. Search
- C. Sub-search
- D. POST
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/CreateworkflowactionsinSplunkWeb
NEW QUESTION 86
Which of the following are valid options with the chart command ?(select all that apply)
- A. split=t
- B. useother=f
- C. transcation=t
- D. usenull=f
Answer: B,D
NEW QUESTION 87
Which of the following Statements about macros is true? (select all that apply)
- A. Argument values are used to resolve the search string at execution time.
- B. Arguments are defined when the macro is created.
- C. Arguments are defined at execution time.
- D. Argument values are used to resolve the search string when the macro is created.
Answer: A,C
NEW QUESTION 88
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
- A. | chart count over user by vendor_action
- B. | chart count by vendor_action over user
- C. | chart count over vendor_action, user
- D. | chart count by vendor_action, user
Answer: B
NEW QUESTION 89
In automatic lookup definitions, the _____ fields are those that are not in the event data.
- A. output
- B. input
Answer: A
NEW QUESTION 90
Which of the following statements describes macros?
- A. A macro is a reusable search string that must have a fixed time range.
- B. A macro is a reusable search string that may have a flexible time range.
- C. A macro is a reusable search string that must contain only a portion of the search.
- D. A macro is a reusable search string that must contain the full search.
Answer: C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros
NEW QUESTION 91
Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status
- A. is looking for all events that include the search terms: fields AND action AND productld AND status
- B. returns a table with 3 columns
- C. users the table command to improve performance
- D. limits the fields are extracted
Answer: D
NEW QUESTION 92
Which of the following statements describes calculated fields?
- A. Calculated fields are a shortcut for repetitive and complex eval commands.
- B. Calculated fields automatically calculate the simple moving average for indexed fields.
- C. Calculated fields are a shortcut for repetitive and complex calc commands.
- D. Calculated fields are only used on fields added by lookups.
Answer: A
NEW QUESTION 93
Which of the following are valid options to speed up reports? (Select all the apply.)
- A. Edit acceleration
- B. Edit schedule
- C. Edit description
- D. Edit permissions
Answer: A
NEW QUESTION 94
......
Get Latest SPLK-1002 Dumps Exam Questions: https://drive.google.com/open?id=1E4qSDbhcfgZamzlzZN1hyg0qOZX6x8dK
Full SPLK-1002 Practice Test and 179 unique questions with explanations waiting just for you, get it now: https://www.itpass4sure.com/SPLK-1002-practice-exam.html
