Weekend Sale - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: mxmas70

Home > Splunk > Splunk Core Certified Power User > SPLK-1002

SPLK-1002 Splunk Core Certified Power User Exam Question and Answers

Question # 4

Which of the following statements about tags is true? (select all that apply.)

A.

Tags are case-insensitive.

B.

Tags are based on field/vale pairs.

C.

Tags categorize events based on a search.

D.

Tags are designed to make data more understandable.

Full Access
Question # 5

Which field extraction method should be selected for comma-separated data?

A.

Regular expression

B.

Delimiters

C.

eval expression

D.

table extraction

Full Access
Question # 6

What does the following search do?

A.

Creates a table of the total count of users and split by corndogs.

B.

Creates a table of the total count of mysterymeat corndogs split by user.

C.

Creates a table with the count of all types of corndogs eaten split by user.

D.

Creates a table that groups the total number of users by vegetarian corndogs.

Full Access
Question # 7

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

A.

Access

B.

Accounting

C.

Authorization

D.

Authentication

Full Access
Question # 8

What is a limitation of searches generated by workflow actions?

A.

Searches generated by workflow action cannot use macros.

B.

Searches generated by workflow actions must be less than 256 characters long.

C.

Searches generated by workflow action must run in the same app as the workflow action.

D.

Searches generated by workflow action run with the same permissions as the user running them.

Full Access
Question # 9

Why are tags useful in Splunk?

A.

Tags look for less specific data.

B.

Tags visualize data with graphs and charts.

C.

Tags group related data together.

D.

Tags add fields to the raw event data.

Full Access
Question # 10

Consider the following search:

index=web sourcetype=access_corabined

The log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a group.

From the following list, which search groups events by jSSESSIONID?

A.

index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267

B.

index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID

C.

index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267

D.

index=web sourcetype=access_combined JSESSTONID

Full Access
Question # 11

What information must be included when using the datamodel command?

A.

status field

B.

Multiple indexes

C.

Data model field name.

D.

Data model dataset name.

Full Access
Question # 12

What happens to the original field name when a field alias is created?

A.

The original field name is not affected by the creation of a field alias.

B.

The original field name is replaced by the field alias within the index.

C.

The original field name is italicized to indicate that it is not an alias.

D.

The original field name still exists in the index but is not visible to the user at search time.

Full Access
Question # 13

Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

A.

is looking for all events that include the search terms: fields AND action AND productld AND status

B.

users the table command to improve performance

C.

limits the fields are extracted

D.

returns a table with 3 columns

Full Access
Question # 14

What are search macros?

A.

Lookup definitions in lookup tables.

B.

Reusable pieces of search processing language.

C.

A method to normalize fields.

D.

Categories of search results.

Full Access
Question # 15

What will you learn from the results of the following search?

sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

A.

The average time elapsed during each transaction for all transactions

B.

The average time for each event within each transaction

C.

The average time between each transaction

Full Access
Question # 16

When should the delimiter method be used in the Field Extractor?

A.

When the events do not have the correct permissions set.

B.

When the events are separated by a consistent character or set of characters.

C.

When the events need a regular expression to define the matching pattern.

D.

When the events need to be calculated using special characters.

Full Access
Question # 17

What is the relationship between data models and pivots?

A.

Data models provide the datasets for pivots.

B.

Pivots and data models have no relationship.

C.

Pivots and data models are the same thing.

D.

Pivots provide the datasets for data models.

Full Access
Question # 18

Which of the following are required to create a POST workflow action?

A.

Label, URI, search string.

B.

XMI attributes, URI, name.

C.

Label, URI, post arguments.

D.

URI, search string, time range picker.

Full Access
Question # 19

Which of the following statements describes the command below (select all that apply)

Sourcetype=access_combined | transaction JSESSIONID

A.

An additional filed named maxspan is created.

B.

An additional field named duration is created.

C.

An additional field named eventcount is created.

D.

Events with the same JSESSIONID will be grouped together into a single event.

Full Access
Question # 20

Which of the following statements describe GET workflow actions?

A.

GET workflow actions must be configured with POST arguments.

B.

Configuration of GET workflow actions includes choosing a sourcetype.

C.

Label names for GET workflow actions must include a field name surrounded by dollar signs.

D.

GET workflow actions can be configured to open the URT link in the current window or in a new window

Full Access
Question # 21

Which of the following statements is true about the root dataset of a data model?

A.

It can contain transforming commands as long as it is a root search dataset.

B.

It will automatically contain knowledge objects associated with the base search.

C.

It must contain the transaction command if it is a root transaction dataset.

D.

It can only contain a base search with no transforming commands.

Full Access
Question # 22

Which of the following is true about a datamodel that has been accelerated?

A.

They can be used with Pivot, the | tstats command, or the | datamodel command.

B.

They can still be used in the Pivot tool but only with the accelerate_pivot capability.

C.

They can no longer be used in the Pivot tool.

D.

They can be used with the |tstats command, but will only return that data which has been accelerated.

Full Access
Question # 23

When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

A.

Tabs

B.

Pipes

C.

Colons

D.

Spaces

Full Access
Question # 24

Which of these stats commands will show the total bytes for each unique combination of page and server?

A.

index=web | stats sum (bytes) BY page BY server

B.

index=web | stats sum (bytes) BY page server

C.

index=web | stats sum(bytes) BY page AND server

D.

index=web | stats sum(bytes) BY values (page) values (server)

Full Access
Question # 25

When does the CIM add-on apply preconfigured data models to the data?

A.

Search time

B.

Index time

C.

On a cron schedule

D.

At midnight

Full Access
Question # 26

A user wants a table that will show the total revenue made for each product in each sales region. Which would be the correct SPL query to use?

A.

index=X sourcetype=Y | chart sum(product) by price AND region

B.

index=X | chart sum(price) by product, region

C.

index=X | chart total(product) over price by region

D.

index=X | chart total(price) by product, region

Full Access
Question # 27

Which of the following can be used with the eval command tostring function (select all that apply)

A.

‘’hex’’

B.

‘’commas’’

C.

‘’Decimal’’

D.

‘’duration’’

Full Access
Question # 28

Which of the following search modes automatically returns all extracted fields in the fields sidebar?

A.

Fast

B.

Smart 

C.

C. Verbose

Full Access
Question # 29

What are the expected search results from executing the following SPL command?

index=network NOT StatusCode=200

A.

Every event in the network index that does not have a value in this field.

B.

Every event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.

C.

Every event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.

D.

No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.

Full Access
Question # 30

Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

A.

| datamodel web search | filed web *

B.

| Search datamodel web web | filed web*

C.

| datamodel web web field | search web*

D.

Datamodel=web | search web | filed web*

Full Access
Question # 31

When used with the timechart command, which value of the limit argument returns all values?

A.

limit=*

B.

limit=all

C.

limit=none

D.

limit=0

Full Access
Question # 32

Tags can reference which of the following knowledge objects?

A.

Lookups and event types only.

B.

Extracted fields, field aliases, calculated fields, lookups, and event types.

C.

Tags cannot reference any of these knowledge objects because tags are the last knowledge objects generated in the search-time operation sequence.

D.

Extracted fields, calculated fields, and field aliases only.

Full Access
Question # 33

This is what Splunk uses to categorize the data that is being indexed.

A.

sourcetype

B.

index

C.

source

D.

host

Full Access
Question # 34

Which of the following statements describes Search workflow actions?

A.

By default. Search workflow actions will run as a real-time search.

B.

Search workflow actions can be configured as scheduled searches,

C.

The user can define the time range of the search when created the workflow action.

D.

Search workflow actions cannot be configured with a search string that includes the transaction command

Full Access
Question # 35

Where are the results of eval commands stored?

A.

In a field.

B.

In an index.

C.

In a KV Store.

D.

In a database.

Full Access
Question # 36

Which of the following statements describes the use of the Field Extractor (FX)?

A.

The Field Extractor automatically extracts all fields at search time.

B.

The Field Extractor uses PERL to extract fields from the raw events.

C.

Fields extracted using the Field Extractor persist as knowledge objects.

D.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

Full Access
Question # 37

Select this in the fields sidebar to automatically pipe you search results to the rare command

A.

events with this field

B.

rare values

C.

top values by time

D.

top values

Full Access
Question # 38

Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

A.

| where 10yearAnnerversary=Renewal-MonthYear

B.

| where ‘10yearAnnerversary=Renewal-MonthYear

C.

| where 10yearAnnerversary=’Renewal-MonthYear’

D.

| where ‘10yearAnnerversary’=’Renewal-MonthYear’

Full Access
Question # 39

When should the regular expression mode of Field Extractor (FX) be used? (select all that apply)

A.

For data cleanly separated by a space, a comma, or a pipe character.

B.

For data in a CSV (comma-separated value) file.

C.

For data with multiple, different characters separating fields.

D.

For unstructured data.

Full Access
Question # 40

Which command is used to create choropleth maps?

A.

geostats

B.

cluster

C.

geom

Full Access
Question # 41

Which of the following is true about the Splunk Common Information Model (CIM)?

A.

The data models included in the CIM are configured with data model acceleration turned off.

B.

The CIM contains 28 pre-configured datasets.

C.

The CIM is an app that needs to run on the indexer.

D.

The data models included in the CIM are configured with data model acceleration turned on.

Full Access
Question # 42

Information needed to create a GET workflow action includes which of the following? (select all that apply.)

A.

A name of the workflow action

B.

A URI where the user will be directed at search time.

C.

A label that will appear in the Event Action menu at search time.

D.

A name for the URI where the user will be directed at search time.

Full Access
Question # 43

A POST workflow action will pass which types of arguments to an external website?

A.

Clear text only.

B.

A mix of clear text strings and variables.

C.

It can only send raw event data.

D.

Variables only.

Full Access
Question # 44

Which of the following knowledge objects can reference field aliases?

A.

Calculated fields, lookups, event types, and tags.

B.

Calculated fields and tags only.

C.

Calculated fields and event types only.

D.

Calculated fields, lookups, event types, and extracted fields.

Full Access
Question # 45

When would a user select delimited field extractions using the Field Extractor (FX)?

A.

When a log file has values that are separated by the same character, for example, commas.

B.

When a log file contains empty lines or comments.

C.

With structured files such as JSON or XML.

D.

When the file has a header that might provide information about its structure or format.

Full Access
Question # 46

These users can create global knowledge objects. (Select all that apply.)

A.

users

B.

power users

C.

administrators

Full Access
Question # 47

What does the fillnull command replace null values with, if the value argument is not specified?

A.

0

B.

N/A

C.

NaN

D.

NULL

Full Access
Question # 48

Which of the following statements describes field aliases?

A.

Field alias names replace the original field name.

B.

Field aliases can be used in lookup file definitions.

C.

Field aliases only normalize data across sources and sourcetypes.

D.

Field alias names are not case sensitive when used as part of a search.

Full Access
Question # 49

When creating a Search workflow action, which field is required?

A.

Search string

B.

Data model name

C.

Permission setting

D.

An eval statement

Full Access
Question # 50

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

A.

Tabs

B.

Pipes

C.

Spaces

D.

Commas

Full Access
Question # 51

What other syntax will produce exactly the same results as | chart count over vendor_action by user?

A.

| chart count by vendor_action, user

B.

| chart count over vendor_action, user

C.

| chart count by vendor_action over user

D.

| chart count over user by vendor_action

Full Access
Question # 52

This clause is used to group the output of a stats command by a specific name.

A.

Rex

B.

As

C.

List

D.

By

Full Access
Question # 53

Which of the following is NOT a stats function:

A.

sum

B.

addtotals

C.

count

D.

avg

Full Access
Question # 54

Which of the following can be saved as an event type?

A.

index=server_48 sourcetype=BETA_881 code=220

B.

index=server_48 sourcetype=BETA_881 code=220 | stats count by code

C.

index=server_48 sourcetype=BETA_881 code=220 | inputlookup append=t servercode.csv

D.

index=server_48 sourcetype=BETA_881 code=220 | stats where code > 220

Full Access
Question # 55

When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied. (Select all that apply).

A.

OR

B.

( )

C.

AND

D.

NOT

Full Access
Question # 56

The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?

A.

KV Store

B.

Lookups

C.

Saved searches

D.

Data models

Full Access
Question # 57

which of the following commands are used when creating visualizations(select all that apply.)

A.

Geom

B.

Choropleth

C.

Geostats

D.

iplocation

Full Access
Question # 58

There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

A.

Event Actions > Extract Fields

B.

Fields sidebar > Extract New Field

C.

Settings > Field Extractions > New Field Extraction

D.

Settings > Field Extractions > Open Field Extraction

Full Access
Question # 59

When using timechart, how many fields can be listed after a by clause?

A.

because timechart doesn't support using a by clause.

B.

because _time is already implied as the x-axis.

C.

because one field would represent the x-axis and the other would represent the y-axis.

D.

There is no limit specific to timechart.

Full Access
Question # 60

A field alias is created where field1—fieid2 and the Overwrite Field Values checkbox is selected.

What happens if an event only contains values for fieid1?

A.

field2 values are removed from the events.

B.

field1 and field2 values are merged.

C.

field2 values are unchanged.

D.

field2 values are replaced with the value of the field1.

Full Access
Question # 61

If a calculated field has the same name as an extracted field, what happens to the extracted field?

A.

The calculated field will override the extracted field.

B.

The calculated and extracted fields will be combined.

C.

The calculated field will duplicate the extracted field.

D.

An error will be returned and the search will fail.

Full Access
Question # 62

The timechart command buckets data in time intervals depending on:

A.

the number of events returned

B.

the selected time range

C.

the type of visualization selected

Full Access
Question # 63

A calculated field may be based on which of the following?

A.

Fields generated within a search string

B.

Lookup tables

C.

Regular expressions

D.

Extracted fields

Full Access
Question # 64

Which of the following searches can be used to define an event type?

A.

index=games sourcetype=score [search index=players | fields player_id]

B.

index=games sourcetype=score I where score>9999

C.

index=games sourcetype=score player=* score>9999

D.

index=games sourcetype=score I stats count by player

Full Access
Question # 65

Which of the following statements describes an event type?

A.

A log level measurement: info, warn, error.

B.

A knowledge object that is applied before fields are extracted.

C.

A field for categorizing events based on a search string.

D.

Either a log, a metric, or a trace.

Full Access
Question # 66

Which search would limit an "alert" tag to the "host" field?

A.

tag=alert

B.

host::tag::alert

C.

tag==alert

D.

tag::host=alert

Full Access
Question # 67

Using the export function, you can export search results as __________.( Select all that apply)

A.

Xml

B.

Json

C.

Html

D.

A php file

Full Access
Question # 68

How is a variable for a macro defined?

A.

Place the variable name inside of curly braces: {variable name}.

B.

Place the variable name inside of asterisks: variable name.

C.

Place the variable name inside of dollar signs: $variable name$.

D.

Place the variable name inside of percentage signs: %variable name%.

Full Access
Question # 69

Which of the following describes this search?

New Search

'third_party_outages(EMEA,-24h)'

A.

This search will find all events for the third_party_outages event type that have "EMEA" or "-24h" in the raw event data.

B.

This search will run the third_party_outages saved search and filter for events containing "EMEA" and "-24h" in the raw event data.

C.

This search will run the third_party_outages macro and pass the arguments EMEA and -24h to the macro definition.

D.

This search will find all events in the third_party_outages index with the tags EMEA and -24h.

Full Access
Question # 70

Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

A.

Macros

B.

Lookups

C.

Workflow actions

D.

Field extractions

Full Access
Question # 71

When using the timechart command, how can a user group the events into buckets based on time?

A.

Using the span argument.

B.

Using the duration argument.

C.

Using the interval argument.

D.

Adjusting the fieldformat options.

Full Access
Question # 72

Which of the following knowledge objects represents the output of an eval expression?

A.

Eval fields

B.

Calculated fields

C.

Field extractions

D.

Calculated lookups

Full Access
Question # 73

Which of the following file formats can be extracted using a delimiter field extraction?

A.

CSV

B.

PDF

C.

XML

D.

JSON

Full Access
Question # 74

Which of the following definitions describes a macro named “samplemacro” that accepts two arguments?

A.

samplemacro(2)

B.

samplemacro(1,2)

C.

samplemacro[2]

D.

samplemacro[1,2]

Full Access
Question # 75

What does the fillnull command do in this search?

index=main sourcetype=http:log | fillnull value="Unknown"

A.

Set the values of the field to null when it is "Unknown".

B.

Set all fields that are null to "Unknown".

C.

Set the values of the field to "Unknown" if it is null.

D.

Set all fields with the value of "Unknown" to null.

Full Access
Question # 76

Which of the following are valid options to speed up reports? (Select all the apply.)

A.

Edit permissions

B.

Edit description

C.

Edit acceleration

D.

Edit schedule

Full Access
Question # 77

Which of the following commands will show the maximum bytes?

A.

sourcetype=access_* | maximum totals by bytes

B.

sourcetype=access_* | avg (bytes)

C.

sourcetype=access_* | stats max(bytes)

D.

sourcetype=access_* | max(bytes)

Full Access
Question # 78

Clicking a SEGMENT on a chart, ________.

A.

drills down for that value

B.

highlights the field value across the chart

C.

adds the highlighted value to the search criteria

Full Access
Question # 79

Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

A.

Convert_sales (euro, €, 79)”

B.

Convert_sales (euro, €, .79)

C.

Convert_sales ($euro,$€$,s79$

D.

Convert_sales ($euro, $€$,S,79$)

Full Access
Question # 80

Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

A.

Auto-Extracted fields can be hidden in Pivot.

B.

Auto-Extracted fields can have their data type changed.

C.

Auto-Extracted fields can be given a friendly name for use in Pivot.

D.

Auto-Extracted fields can be added if they already exist in the dataset with constraints.

Full Access
Question # 81

Which search string would only return results for an event type called success ful_purchases?

A.

tag=success ful_purchases

B.

Event Type:: successful purchases

C.

successful_purchases

D.

event type—success ful_purchases

Full Access
Question # 82

Data models are composed of one or more of which of the following datasets? (select all that apply)

A.

Transaction datasets

B.

Events datasets

C.

Search datasets

D.

Any child of event, transaction, and search datasets

Full Access
Question # 83

What are the expected results for a search that contains the command | where A=B?

A.

Events that contain the string value where A=B.

B.

Events that contain the string value A=B.

C.

Events where values of field are equal to values of field B.

D.

Events where field A contains the string value B.

Full Access
Question # 84

The fields sidebar does not show________. (Select all that apply.)

A.

interesting fields

B.

selected fields

C.

all extracted fields

Full Access
Question # 85

Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

A.

maxpause

B.

endswith

C.

maxduration

D.

maxspan

Full Access
Question # 86

What field must be present in order to use the timechart command?

A.

_raw

B.

rime

C.

_time

D.

index

Full Access
Question # 87

__________ datasets can be added to root dataset to narrow down the search

A.

parent

B.

extracted

C.

event

D.

child

Full Access
Question # 88

What is the purpose of a calculated field?

A.

To automatically add fields to the index using an eval expression rather than manually including an eval command.

B.

To manually add and remove fields at search time related to statistical functions.

C.

To automatically add fields at search time using an eval expression rather than manually including an eval command.

D.

To manually add fields at search time and check for syntax errors.

Full Access
Question # 89

How is a macro referenced in a search?

A.

By using the macroname command.

B.

By using the macro command.

C.

By enclosing the macro name in backtick characters (‘).

D.

By enclosing the macro name in single-quote characters (‘).

Full Access
Question # 90

The timechart command is an example of which of the following command types?

A.

Orchestrating

B.

Transforming

C.

Statistical

D.

Generating

Full Access
Question # 91

Which of the following about reports is/are true?

A.

Reports are knowledge objects.

B.

Reports can be scheduled.

C.

Reports can run a script.

D.

All of the above.

Full Access