29 October, 2020

How Many Questions Of SPLK-1002 Dumps Questions

Want to know Exambible SPLK-1002 Exam practice test features? Want to lear more about Splunk Splunk Core Certified Power User Exam certification experience? Study Validated Splunk SPLK-1002 answers to Latest SPLK-1002 questions at Exambible. Gat a success with an absolute guarantee to pass Splunk SPLK-1002 (Splunk Core Certified Power User Exam) test on your first attempt.

Free SPLK-1002 Demo Online For Splunk Certifitcation:

Page: 1 / 12

Total 153 questions Full Exam Access

Question 1

- (Exam Topic 1)
Which of the following statements describe calculated fields? (select all that apply)

A.

Calculated fields can be used in the search bar.

B.

Calculated fields can be based on an extracted field.

C.

Calculated fields can only be applied to host and sourcetype.

D.

Calculated fields are shortcuts for performing calculations using the eval command.

Question 2

- (Exam Topic 2)
Which of the following searches will show the number of categoryld used by each host?

A.

Sourcetype=access_* |sum bytes by host

B.

Sourcetype=access_* |stats sum(categoryl

C.

by host

D.

Sourcetype=access_* |sum(bytes) by host

E.

Sourcetype=access_* |stats sum by host

Question 3

- (Exam Topic 1)
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

A.

Tabs

B.

Pipes

C.

Colons

D.

Spaces

Question 4

- (Exam Topic 1)
What does the transaction command do?

A.

Groups a set of transactions based on time.

B.

Creates a single event from a group of events.

C.

Separates two events based on one or more values.

D.

Returns the number of credit card transactions found in the event logs.

Question 5

- (Exam Topic 1)
Which delimiters can the Field Extractor (FX) detect? (select all that apply)

A.

Tabs

B.

Pipes

C.

Spaces

D.

Commas

Question 6

- (Exam Topic 1)
Which are valid ways to create an event type? (select all that apply)

A.

By using the searchtypes command in the search bar.

B.

By editing the event_type stanza in the props.conf file.

C.

By going to the Settings menu and clicking Event Types > New.

D.

By selecting an event in search results and clicking Event Actions > Build Event Type.

Question 7

- (Exam Topic 1)
Calculated fields can be based on which of the following?

A.

Tags

B.

Extracted fields

C.

Output fields for a lookup

D.

Fields generated from a search string

Question 8

- (Exam Topic 1)
A space is an implied _____ in a search string.

A.

OR

B.

AND

C.

()

D.

NOT

Question 9

- (Exam Topic 1)
When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

A.

The regex can no longer be edited.

B.

The field being extracted will be required for all future events.

C.

The events without the required field will not display in searches.

D.

Only events with the required string will be included in the extraction.

Question 10

- (Exam Topic 1)
When using timechart, how many fields can be listed after a by clause? ( Choose Two )

A.

because timechart doesn\'t support using a by clause.

B.

because _time is already implied as the x-axis.

C.

because one field would represent the x-axis and the other would represent the y-axis.

D.

There is no limit specific to timechart.

Question 11

- (Exam Topic 1)
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

A.

CIM is a methodology for normalizing data.

B.

CIM can correlate data from different sources.

C.

The Knowledge Manager uses the CIM to create knowledge objects.

D.

CIM is an app that can coexist with other apps on a single Splunk deployment.

Question 12

- (Exam Topic 1)
Which of the following statements describes macros?

A.

A macro is a reusable search string that must contain the full search.

B.

A macro is a reusable search string that must have a fixed time range.

C.

A macro Is a reusable search string that may have a flexible time range.

D.

A macro Is a reusable search string that must contain only a portion of the search.

Question 13

- (Exam Topic 1)
The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

A.

Fast mode is enabled.

B.

The dashboard is private.

C.

The extraction is private

D.

The person in the organization running the report does not have access to the index.

Question 14

- (Exam Topic 1)
Which of the following file formats can be extracted using a delimiter field extraction?

A.

CSV

B.

PDF

C.

XML

D.

JSON

Question 15

- (Exam Topic 1)
Which of the following statements is true, especially in large environments?

A.

Use the scats command when you next to group events by two or more fields.

B.

The stats command is faster and more efficient than the transaction command

C.

The transaction command is faster and more efficient than the stats command.

D.

Use the transaction command when you want to see the results of a calculation.

Question 16

- (Exam Topic 1)
Which of the following statements describes Search workflow actions?

A.

By defaul

B.

Search workflow actions will run as a real-time search.

C.

Search workflow actions can be configured as scheduled searches,

D.

The user can define the time range of the search when created the workflow action.

E.

Search workflow actions cannot be configured with a search string that includes the transaction command

Question 17

- (Exam Topic 2)
What is a limitation of searches generated by workflow actions?

A.

Searches generated by workflow action cannot use macros.

B.

Searches generated by workflow actions must be less than 256 characters long.

C.

Searches generated by workflow action must run in the same app as the workflow action.

D.

Searches generated by workflow action run with the same permissions as the user running them.

Question 18

- (Exam Topic 1)
What are the two parts of a root event dataset?

A.

Fields and variables.

B.

Fields and attributes.

C.

Constraints and fields.

D.

Constraints and lookups.

Question 19

- (Exam Topic 1)
Which of the following knowledge objects represents the output of an oval expression?

A.

Eval fields

B.

Calculated fields

C.

Field extractions

D.

Calculated lookups

Question 20

- (Exam Topic 1)
Which of the following are required to create a POST workflow action?

A.

Label, URI, search string.

B.

XMI attributes, URI, name.

C.

Label, URI, post arguments.

D.

URI, search string, time range picker.

Question 21

- (Exam Topic 1)
When creating a Search workflow action, which field is required?

A.

Search string

B.

Data model name

C.

Permission setting

D.

An eval statement

Question 22

- (Exam Topic 1)
Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID

A.

An additional filed named maxspan is created.

B.

An additional Held named duration is created.

C.

An additional field named eventcount is created.

D.

Events with the same JSESSIONID will be grouped together into a single event.

Page: 1 / 12

Total 153 questions Full Exam Access

Web Analytics