Updated Dumps for Splunk SPLK-1002 Exam

dumps2021-09-03T07:22:41+08:00

New updated Splunk certification SPLK-1002 exam dumps are available, which will be valid in the preparation. After passing Splunk SPLK-1002 exam, you will have a basic understanding of SPL searching and reporting commands. Free Splunk certification SPLK-1002 exam updated dumps are available below.

Page 1 of 4

1. The transaction command allows you to __________ events across multiple sources

duplicate

correlate

persist

tag

2. A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

skipped or deferred

automatically accelerated

deleted

all of the above

3. __________ datasets can be added to root dataset to narrow down the search

parent

extracted

event

child

4. A real-time alert is ______________.

A scheduled alert

constantly running in the background

5. Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

Macros

Lookups

Workflow actions

Field extractions

6. Information needed to create a GET workflow action includes which of the following? (select all that apply.)

A name of the workflow action

A URI where the user will be directed at search time.

A label that will appear in the Event Action menu at search time.

A name for the URI where the user will be directed at search time.

7. Which search would limit an "alert" tag to the "host" field?

tag=alert

host::tag::alert

tag==alert

tag::host=alert

8. These allow you to categorize events based on search terms. Select your answer.

Groups

Event Types

Macros

Tags

9. Which of the following statements would help a user choose between the transaction and stats commands?

state can only group events using IP addresses.

The transaction command is faster and more efficient.

There is a 1000 event limitation with the transaction command.

Use state when the events need to be viewed as a single event.

10. For choropleth maps,splunk ships with the following KMZ files (select all that apply)

States of the United States

States and provinces of the united states and Canada

Countries of the European Union

Countries of the World

11. When you mouse over and click to add a search term this (these. Boolean operator(s) is(are. not implied. (Select all that apply).

( )

AND

NOT

12. By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Turned off

Turned on

Determined automatically based on the sourcetype.

Determined automatically based on the data source.

13. The fields sidebar does not show________. (Select all that apply.)

interesting fields

selected fields

all extracted fields

14. When extracting fields, we may choose to use our own regular expressions

True

False

15. The gauge command:

creates a single-value visualization

allows you to set colored ranges for a single-value visualization

creates a radial gauge visualization

16. which of the following are valid options with the chart command

useother

usenull

fillfield

usefiled

17. In which Settings section are macros defined?

Fields

Tokens

Advanced Search

Searches, Reports, Alerts

18. Highlighted search terms indicate _________ search results in Splunk.

Display as selected fields.

Sorted

Charted based on time

Matching

19. There are several ways to access the field extractor.

Which option automatically identifies data type, source type, and sample event?

Event Actions > Extract Fields

Fields sidebar > Extract New Field

Settings > Field Extractions > New Field Extraction

Settings > Field Extractions > Open Field Extraction

20. Which of the following searches would return a report of sales by product-name?

chart sales by product_name

chart sum(price) as sales by product_name

stats sum(price) as sales over product_name

timechart list(sales), values(product_name)

Page 2 of 4

21. How many ways are there to access the Field Extractor Utility?

22. Which of the following statements describes POST workflow actions?

Configuration of a POST workflow action includes choosing a sourcetype.

POST workflow actions can be configured to send email to the URI location.

By default, POST workflow action are shown in both the event and field menus.

POST workflow actions can be configured to send POST arguments to the URI location.

23. The stats command will create a _____________ by default.

Table

Report

Pie chart

24. What is the correct way to name a macro with two arguments?

us_sales2

us_sales(1,2)

us_sale,2

us_sales(2)

25. What other syntax will produce exactly the same results as | chart count over vendor_action by user?

| chart count by vendor_action, user

| chart count over vendor_action, user

| chart count by vendor_action over user

| chart count over user by vendor_action

26. Which type of visualization shows relationships between discrete values in three dimensions?

Pie chart

Line chart

Bubble chart

Scatter chart

27. When can a pipe follow a macro?

A pipe may always follow a macro.

The current user must own the macro.

The macro must be defined in the current app.

Only when sharing is set to global for the macro.

28. Which is not a comparison operator in Splunk

29. A data model can consist of what three types of datasets?

Pivot, searches, and events.

Pivot, events, and transactions.

Searches, transactions, and pivot.

Events, searches, and transactions.

30. When using the timechart command, how can a user group the events into buckets based on time?

Using the span argument.

Using the duration argument.

Using the interval argument.

Adjusting the fieldformat options.

31. During the validation step of the Field Extractor workflow: Select your answer.

You can remove values that aren't a match for the field you want to define

You can validate where the data originated from

You cannot modify the field extraction

32. Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Fast

Smart

Verbose

33. Which of these is NOT a field that is automatically created with the transaction command?

maxcount

duration

eventcount

34. Which of the following search control will not re-rerun the search? (Select all that apply.)

zoom out

selecting a bar on the timeline

deselect

selecting a range of bars on the timelines

35. Which of the following is a function of the Splunk Common Information Model (CIM)?

Normalizing data across a Splunk deployment.

Providing templates for reports and dashboards.

Algorithmically shifting events to other indexes.

Reingesting previously indexed data with new field names.

36. This role is required to install the CIM Add-on.

Select your answer.

ADMIN

POWER

USER

37. When using a split series on a chart, the series MUST be displayed using the STACKED option.

True

False

38. Which command can include both an over and a by clause to divide results into sub-groupings?

chart

stats

xyseries

transaction

39. Splunk alerts can be based on search that run______. (Select all that apply.)

in real-time

on a regular schedule

and have no matching events

40. Clicking a SEGMENT on a chart, ________.

drills down for that value

highlights the field value across the chart

adds the highlighted value to the search criteria

Page 3 of 4

41. Which of the following statements describes the use of the Filed Extractor (FX)?

The Field Extractor automatically extracts all field at search time.

The Field Extractor uses PERL to extract field from the raw events.

Field extracted using the Extracted persist as knowledge objects.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

42. When using the transaction command, what does the argument maxspan do?

Sets the maximum total time between events in a transaction.

Sets the maximum length of all events within a transaction.

Sets the maximum total time between the earliest and latest events in a transaction.

Sets the maximum length that any single event can reach to be included in the transaction.

43. Which workflow uses field values to perform a secondary search?

POST

Action

Sub-Search

44. Which of the following are required to create a POST workflow action?

Label, URI, search string.

XMI attributes, URI, name.

Label, URI, post arguments.

URI, search string, time range picker.

45. What does the transaction command do?

Groups a set of transactions based on time.

Creates a single event from a group of events.

Separates two events based on one or more values.

Returns the number of credit card transactions found in the event logs.

46. Which of the following statements describes macros?

A macro is a reusable search string that must contain the full search.

A macro is a reusable search string that must have a fixed time range.

A macro Is a reusable search string that may have a flexible time range.

A macro Is a reusable search string that must contain only a portion of the search.

47. Which of the following describes the Splunk Common Information Model (CIM) add-on?

The CIM add-on uses machine learning to normalize data.

The CIM add-on contains dashboards that show how to map data.

The CIM add-on contains data models to help you normalize data.

The CIM add-on is automatically installed in a Splunk environment.

48. What does the fillnull command replace null values with, it the value argument is not specified?

N/A

NaN

NULL

49. What do events in a transaction have In common?

All events In a transaction must have the same timestamp.

All events in a transaction must have the same sourcetype.

All events in a transaction must have the exact same set of fields.

All events in a transaction must be related by one or more fields.

50. A user wants to convert numeric field values to strings and also to sort on those values.

Which command should be used first, the eval or the sort?

It doesn't matter whether eval or sort is used first.

Convert the numeric to a string with eval first, then sort.

Use sort first, then convert the numeric to a string with eval.

You cannot use the sort command and the eval command on the same field.

51. When should you use the transaction command instead of the scats command?

When you need to group on multiple values.

When duration is irrelevant in search results. .

When you have over 1000 events in a transaction.

When you need to group based on start and end constraints.

52. Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Convert_sales (euro, , 79)”

Convert_sales (euro, , .79)

Convert_sales ($euro,$$,s79$

Convert_sales ($euro, $$,S,79$)

53. What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Custom visualizations

Pre-configured data models

Fields and event category tags

Automatic data model acceleration

54. In what order arc the following knowledge objects/configurations applied?

Field Aliases, Field Extractions, Lookups

Field Extractions, Field Aliases, Lookups

Field Extractions, Lookups, Field Aliases

Lookups, Field Aliases, Field Extractions

55. Calculated fields can be based on which of the following?

Tags

Extracted fields

Output fields for a lookup

Fields generated from a search string

56. Which of the following statements describe data model acceleration? (select all that apply)

Root events cannot be accelerated.

Accelerated data models cannot be edited.

Private data models cannot be accelerated.

You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.

57. Which group of users would most likely use pivots?

Users

Architects

Administrators

Knowledge Managers

58. Which of the following actions can the eval command perform?

Remove fields from results.

Create or replace an existing field.

Group transactions by one or more fields.

Save SPL commands to be reused in other searches.

59. Which of the following statements describe calculated fields? (select all that apply)

Calculated fields can be used in the search bar.

Calculated fields can be based on an extracted field.

Calculated fields can only be applied to host and sourcetype.

Calculated fields are shortcuts for performing calculations using the eval command.

60. Data model fields can be added using the Auto-Extracted method.

Which of the following statements describe Auto-Extracted fields? (select all that apply)

Auto-Extracted fields can be hidden in Pivot.

Auto-Extracted fields can have their data type changed.

Auto-Extracted fields can be given a friendly name for use in Pivot.

Auto-Extracted fields can be added if they already exist in the dataset with constraints.

Page 4 of 4

61. Data model are composed of one or more of which of the following datasets? (select all that apply.)

Events datasets

Search datasets

Transaction datasets

Any child of event, transaction, and search datasets

62. When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

Rank

Weight

Priority

Precedence

63. What is the correct syntax to search for a tag associated with a value on a specific fields?

Tag-<field?

Tag<filed(tagname.)

Tag=<filed>::<tagname>

Tag::<filed>=<tagname>

64. A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.

Which field name appears in the results?

Both will appear in the All Fields list, but only if the alias is specified in the search.

Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

65. Which of the following searches show a valid use of macro? (Select all that apply)

index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField

index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

66. Which of the following statements describe the search below? (select all that apply)

Index=main I transaction clientip host maxspan=30s maxpause=5s

Events in the transaction occurred within 5 seconds.

It groups events that share the same clientip and host.

The first and last events are no more than 5 seconds apart.

The first and last events are no more than 30 seconds apart.

Updated Dumps for Splunk SPLK-1002 Exam

Updated Dumps for Splunk SPLK-1002 Exam

Share this post

Leave a Reply Cancel reply

Related Posts

Great Splunk Core Certified Power User SPLK-1002 Dumps Questions

Splunk Enterprise Security Certified Admin SPLK-3001 Free Dumps

SPLK-1001 Splunk Core Certified User Exam Dumps

Splunk SPLK-2003 Dumps Questions Available

SPLK-3002 Splunk IT Service Intelligence Certified Admin Exam Questions

Good SPLK-4001 Exam Dumps Help You Become a Splunk O11y Cloud Certified Metrics User

Splunk Enterprise Certified Admin SPLK-1003 Exam Questions