Weekend Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70special

Splunk SPLK-1002 Splunk Core Certified Power User Exam Exam Practice Test

Page: 1 / 29
Total 285 questions

Splunk Core Certified Power User Exam Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$37.5  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$33  $109.99
Question 1

When using | timechart by host, which field is represented in the x-axis?

Options:

A.

date

B.

host

C.

time

D.

_time

Question 2

A search contains example(100,200). What is the name of the macro?

Options:

A.

example(2)

B.

example(var1,var2)

C.

example($,$)

D.

example[2]

Question 3

Which command can include both an over and a by clause to divide results into sub-groupings?

Options:

A.

chart

B.

stats

C.

xyseries

D.

transaction

Question 4

What is the correct syntax to find events associated with a tag?

Options:

A.

tag:=

B.

tags=

C.

tags:=

D.

tag=

Question 5

Which of the following is a feature of the Pivot tool?

Options:

A.

Creates lookups without using SPL.

B.

Data Models are not required.

C.

Creates reports without using SPL

D.

Datasets are not required.

Question 6

Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

Options:

A.

| where 10yearAnnerversary=Renewal-MonthYear

B.

| where ‘10yearAnnerversary=Renewal-MonthYear

C.

| where 10yearAnnerversary=’Renewal-MonthYear’

D.

| where ‘10yearAnnerversary’=’Renewal-MonthYear’

Question 7

Why would the transaction command be used instead of the stats command?

Options:

A.

The transaction command has better search-time performance.

B.

The transaction command can perform calculations on fields.

C.

The transaction command keeps the raw data for each event.

D.

The transaction command is less resource-intensive.

Question 8

Which of the following examples would use a POST workflow action?

Options:

A.

Perform an external IP lookup based on a domain value found in events.

B.

Use the field values in an HTTP error event to create a new ticket in an external system.

C.

Launch secondary Splunk searches that use one or more field values from selected events.

D.

Open a web browser to look up an HTTP status code.

Question 9

There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

Options:

A.

Event Actions > Extract Fields

B.

Fields sidebar > Extract New Field

C.

Settings > Field Extractions > New Field Extraction

D.

Settings > Field Extractions > Open Field Extraction

Question 10

What are the expected results for a search that contains the command | where A=B?

Options:

A.

Events that contain the string value where A=B.

B.

Events that contain the string value A=B.

C.

Events where values of field are equal to values of field B.

D.

Events where field A contains the string value B.

Question 11

which of the following commands are used when creating visualizations(select all that apply.)

Options:

A.

Geom

B.

Choropleth

C.

Geostats

D.

iplocation

Question 12

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Options:

A.

There is a limit to the number of fields that can be extracted.

B.

The user is unable to preview the extractions.

C.

The extraction is added at index time.

D.

The user is unable to return to the automatic field extraction workflow.

Question 13

What is the correct format for naming a macro with multiple arguments?

Options:

A.

monthly_sales(argument 1, argument 2, argument 3)

B.

monthly_sales(3)

C.

monthly_sales[3]

D.

monthly_sales[argument 1, argument 2, argument 3)

Question 14

Which of the following searches would create a graph similar to the one below?

Options:

A.

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

B.

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

C.

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

D.

None of these searches would generate a similart graph.

Question 15

Which search string would only return results for an event type called success ful_purchases?

Options:

A.

tag=success ful_purchases

B.

Event Type:: successful purchases

C.

successful_purchases

D.

event type—success ful_purchases

Question 16

To which of the following can a field alias be applied?

Options:

A.

Data found in a lookup table.

B.

Either a calculated field or an extracted field.

C.

Only one single field in a dataset.

D.

A given host, source, or sourcetype.

Question 17

By default search results are not returned in ________ order.

Options:

A.

Chronological

B.

Reverser chronological

C.

ASCIE

D.

Alphabetical

Question 18

A user runs the following search:

index—X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother—f

Which of the following table headers match the order this command creates?

Options:

A.

The chart command does not allow for multiple statistical functions.

B.

Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase

C.

Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

D.

Count: product, sum: product, count: action, sum: action

Question 19

When using the timechart command, how can a user group the events into buckets based on time?

Options:

A.

Using the span argument.

B.

Using the duration argument.

C.

Using the interval argument.

D.

Adjusting the fieldformat options.

Question 20

What are the expected search results from executing the following SPL command?

index=network NOT StatusCode=200

Options:

A.

Every event in the network index that does not have a value in this field.

B.

Every event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.

C.

Every event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.

D.

No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.

Question 21

The transaction command allows you to __________ events across multiple sources

Options:

A.

duplicate

B.

correlate

C.

persist

D.

tag

Question 22

Which of the following searches can be used to define an event type?

Options:

A.

index=games sourcetype=score [search index=players | fields player_id]

B.

index=games sourcetype=score I where score>9999

C.

index=games sourcetype=score player=* score>9999

D.

index=games sourcetype=score I stats count by player

Question 23

Which command is used to create choropleth maps?

Options:

A.

geostats

B.

cluster

C.

geom

Question 24

These kinds of charts represent a series in a single bar with multiple sections

Options:

A.

Multi-Series

B.

Split-Series

C.

Omit nulls

D.

Stacked

Question 25

Which of these stats commands will show the total bytes for each unique combination of page and server?

Options:

A.

index=web | stats sum (bytes) BY page BY server

B.

index=web | stats sum (bytes) BY page server

C.

index=web | stats sum(bytes) BY page AND server

D.

index=web | stats sum(bytes) BY values (page) values (server)

Question 26

A POST workflow action will pass which types of arguments to an external website?

Options:

A.

Clear text only.

B.

A mix of clear text strings and variables.

C.

It can only send raw event data.

D.

Variables only.

Question 27

What is the purpose of a calculated field?

Options:

A.

To automatically add fields to the index using an eval expression rather than manually including an eval command.

B.

To manually add and remove fields at search time related to statistical functions.

C.

To automatically add fields at search time using an eval expression rather than manually including an eval command.

D.

To manually add fields at search time and check for syntax errors.

Question 28

Which of the following options will define the first event in a transaction?

Options:

A.

startswith

B.

with

C.

startingwith

D.

firstevent

Question 29

Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

Options:

A.

maxpause

B.

endswith

C.

maxduration

D.

maxspan

Question 30

What fields does the transaction command add to the raw events? (select all that apply)

Options:

A.

count

B.

duration

C.

eventcount

D.

transaction id

Question 31

This clause is used to group the output of a stats command by a specific name.

Options:

A.

Rex

B.

As

C.

List

D.

By

Question 32

Which of the following objects can a calculated field use as a source?

Options:

A.

An alias of a field.

B.

A field added by an automatic lookup.

C.

The tag field.

D.

The eventtype field.

Question 33

If there are fields in the data with values that are " " or empty but not null, which of the following would add a value?

Options:

A.

| eval notNULL = if(isnull (notNULL), “0” notNULL)

B.

| eval notNULL = if(isnull (notNULL), “0”

C.

| eval notNULL = “” | nullfill value=0 notNULL

D.

| eval notNULL = “” fillnull value=0 notNULL

Question 34

A user wants to create a new field alias for a field that appears in two sourcetypes.

How many field aliases need to be created?

Options:

A.

One.

B.

Two.

C.

It depends on whether the original fields have the same name.

D.

It depends on whether the two sourcetypes are associated with the same index.

Question 35

Which of the following searches will return all clientip addresses that start with 108?

Options:

A.

… | where like (clientip, “108.% )

B.

… | where (clientip, "108. %")

C.

… | where (clientip=108. % )

D.

… | search clientip=108

Question 36

When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

Options:

A.

index or source

B.

sourcetype or host

C.

index or sourcetype

D.

sourcetype or source

Question 37

Which of the following statements would help a user choose between the transaction and stats commands?

Options:

A.

state can only group events using IP addresses.

B.

The transaction command is faster and more efficient.

C.

There is a 1000 event limitation with the transaction command.

D.

Use state when the events need to be viewed as a single event.

Question 38

What is needed to define a calculated field?

Options:

A.

Eval expression

B.

Data model

C.

Event type

D.

Regular expression

Question 39

Why are tags useful in Splunk?

Options:

A.

Tags look for less specific data.

B.

Tags visualize data with graphs and charts.

C.

Tags group related data together.

D.

Tags add fields to the raw event data.

Question 40

Which of the following searches will return events containing a tag named Privileged?

Options:

A.

tag=Priv

B.

tag=Priv*

C.

tag=priv*

D.

tag=privileged

Question 41

Which of the following searches will show the number of categoryld used by each host?

Options:

A.

Sourcetype=access_* |sum bytes by host

B.

Sourcetype=access_* |stats sum(categorylD. by host

C.

Sourcetype=access_* |sum(bytes) by host

D.

Sourcetype=access_* |stats sum by host

Question 42

The gauge command:

Options:

A.

creates a single-value visualization

B.

allows you to set colored ranges for a single-value visualization

C.

creates a radial gauge visualization

Question 43

Which of the following knowledge objects can reference field aliases?

Options:

A.

Calculated fields, lookups, event types, and tags.

B.

Calculated fields and tags only.

C.

Calculated fields and event types only.

D.

Calculated fields, lookups, event types, and extracted fields.

Question 44

What are the two parts of a root event dataset?

Options:

A.

Fields and variables.

B.

Fields and attributes.

C.

Constraints and fields.

D.

Constraints and lookups.

Question 45

Which of the following statements describes the command below (select all that apply)

Sourcetype=access_combined | transaction JSESSIONID

Options:

A.

An additional filed named maxspan is created.

B.

An additional field named duration is created.

C.

An additional field named eventcount is created.

D.

Events with the same JSESSIONID will be grouped together into a single event.

Question 46

What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Options:

A.

Custom visualizations

B.

Pre-configured data models

C.

Fields and event category tags

D.

Automatic data model acceleration

Question 47

Which of the following statements about data models and pivot are true? (select all that apply)

Options:

A.

They are both knowledge objects.

B.

Data models are created out of datasets called pivots.

C.

Pivot requires users to input SPL searches on data models.

D.

Pivot allows the creation of data visualizations that present different aspects of a data model.

Question 48

Which of the following statements describe calculated fields? (select all that apply)

Options:

A.

Calculated fields can be used in the search bar.

B.

Calculated fields can be based on an extracted field.

C.

Calculated fields can only be applied to host and sourcetype.

D.

Calculated fields are shortcuts for performing calculations using the eval command.

Question 49

Which of the following statements describes field aliases?

Options:

A.

Field alias names replace the original field name.

B.

Field aliases can be used in lookup file definitions.

C.

Field aliases only normalize data across sources and sourcetypes.

D.

Field alias names are not case sensitive when used as part of a search.

Question 50

Which of the following workflow actions can be executed from search results? (select all that apply)

Options:

A.

GET

B.

POST

C.

LOOKUP

D.

Search

Question 51

What does the transaction command do?

Options:

A.

Groups a set of transactions based on time.

B.

Creates a single event from a group of events.

C.

Separates two events based on one or more values.

D.

Returns the number of credit card transactions found in the event logs.

Question 52

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Options:

A.

The regex can no longer be edited.

B.

The field being extracted will be required for all future events.

C.

The events without the required field will not display in searches.

D.

Only events with the required string will be included in the extraction.

Question 53

Which of the following statements describes Search workflow actions?

Options:

A.

By default. Search workflow actions will run as a real-time search.

B.

Search workflow actions can be configured as scheduled searches,

C.

The user can define the time range of the search when created the workflow action.

D.

Search workflow actions cannot be configured with a search string that includes the transaction command

Question 54

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Options:

A.

Index-main | REJECT trans sessionid

B.

Index-main | transaction sessionid | search REJECT

C.

Index=main | transaction sessionid | whose transaction=reject

D.

Index=main | transaction sessionid | where transaction=reject’’

Question 55

Which of the following can be used with the eval command tostring function (select all that apply)

Options:

A.

‘’hex’’

B.

‘’commas’’

C.

‘’Decimal’’

D.

‘’duration’’

Question 56

Which of the following actions can the eval command perform?

Options:

A.

Remove fields from results.

B.

Create or replace an existing field.

C.

Group transactions by one or more fields.

D.

Save SPL commands to be reused in other searches.

Question 57

After manually editing; a regular expression (regex), which of the following statements is true?

Options:

A.

Changes made manually can be reverted in the Field Extractor (FX) UI.

B.

It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

C.

It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.

D.

The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

Question 58

Which of the following statements describes POST workflow actions?

Options:

A.

POST workflow actions are always encrypted.

B.

POST workflow actions cannot use field values in their URI.

C.

POST workflow actions cannot be created on custom sourcetypes.

D.

POST workflow actions can open a web page in either the same window or a new .

Question 59

Data model are composed of one or more of which of the following datasets? (select all that apply.)

Options:

A.

Events datasets

B.

Search datasets

C.

Transaction datasets

D.

Any child of event, transaction, and search datasets

Question 60

Which of the following Statements about macros is true? (select all that apply)

Options:

A.

Arguments are defined at execution time.

B.

Arguments are defined when the macro is created.

C.

Argument values are used to resolve the search string at execution time.

D.

Argument values are used to resolve the search string when the macro is created.

Question 61

Which of the following file formats can be extracted using a delimiter field extraction?

Options:

A.

CSV

B.

PDF

C.

XML

D.

JSON

Question 62

What does the following search do?

Options:

A.

Creates a table of the total count of users and split by corndogs.

B.

Creates a table of the total count of mysterymeat corndogs split by user.

C.

Creates a table with the count of all types of corndogs eaten split by user.

D.

Creates a table that groups the total number of users by vegetarian corndogs.

Question 63

A space is an implied _____ in a search string.

Options:

A.

OR

B.

AND

C.

()

D.

NOT

Question 64

Selected fields are displayed ______each event in the search results.

Options:

A.

below

B.

interesting fields

C.

other fields

D.

above

Question 65

Which of the following statements describe the search string below?

| datamodel Application_State All_Application_State search

Options:

A.

Evenrches would return a report of sales by state.

B.

Events will be returned from the data model named Application_State.

C.

Events will be returned from the data model named All_Application_state.

D.

No events will be returned because the pipe should occur after the datamodel command

Question 66

Which of the following statements describe data model acceleration? (select all that apply)

Options:

A.

Root events cannot be accelerated.

B.

Accelerated data models cannot be edited.

C.

Private data models cannot be accelerated.

D.

You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.

Question 67

Which of the following statements about event types is true? (select all that apply)

Options:

A.

Event types can be tagged.

B.

Event types must include a time range,

C.

Event types categorize events based on a search.

D.

Event types can be a useful method for capturing and sharing knowledge.

Question 68

Which one of the following statements about the search command is true?

Options:

A.

It does not allow the use of wildcards.

B.

It treats field values in a case-sensitive manner.

C.

It can only be used at the beginning of the search pipeline.

D.

It behaves exactly like search strings before the first pipe.

Question 69

When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

Options:

A.

Rank

B.

Weight

C.

Priority

D.

Precedence

Question 70

What do events in a transaction have In common?

Options:

A.

All events In a transaction must have the same timestamp.

B.

All events in a transaction must have the same sourcetype.

C.

All events in a transaction must have the exact same set of fields.

D.

All events in a transaction must be related by one or more fields.

Question 71

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Options:

A.

Tabs

B.

Pipes

C.

Spaces

D.

Commas

Question 72

Which of the following statements describe GET workflow actions?

Options:

A.

GET workflow actions must be configured with POST arguments.

B.

Configuration of GET workflow actions includes choosing a sourcetype.

C.

Label names for GET workflow actions must include a field name surrounded by dollar signs.

D.

GET workflow actions can be configured to open the URT link in the current window or in a new window

Question 73

Which of the following statements describes this search?

sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

Options:

A.

This is a valid search and will display a timechart of the average duration, of each transaction event.

B.

This is a valid search and will display a stats table showing the maximum pause among transactions.

C.

No results will be returned because the transaction command must include the startswith and endswith options.

D.

No results will be returned because the transaction command must be the last command used in the search pipeline.

Question 74

What is the relationship between data models and pivots?

Options:

A.

Data models provide the datasets for pivots.

B.

Pivots and data models have no relationship.

C.

Pivots and data models are the same thing.

D.

Pivots provide the datasets for data models.

Question 75

Which of the following are required to create a POST workflow action?

Options:

A.

Label, URI, search string.

B.

XMI attributes, URI, name.

C.

Label, URI, post arguments.

D.

URI, search string, time range picker.

Question 76

Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Options:

A.

CIM is a methodology for normalizing data.

B.

CIM can correlate data from different sources.

C.

The Knowledge Manager uses the CIM to create knowledge objects.

D.

CIM is an app that can coexist with other apps on a single Splunk deployment.

Question 77

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Options:

A.

Both will appear in the All Fields list, but only if the alias is specified in the search.

B.

Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

C.

The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

D.

The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Question 78

When should you use the transaction command instead of the scats command?

Options:

A.

When you need to group on multiple values.

B.

When duration is irrelevant in search results. .

C.

When you have over 1000 events in a transaction.

D.

When you need to group based on start and end constraints.

Question 79

Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Options:

A.

Auto-Extracted fields can be hidden in Pivot.

B.

Auto-Extracted fields can have their data type changed.

C.

Auto-Extracted fields can be given a friendly name for use in Pivot.

D.

Auto-Extracted fields can be added if they already exist in the dataset with constraints.

Question 80

The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

Options:

A.

Fast mode is enabled.

B.

The dashboard is private.

C.

The extraction is private-

D.

The person in the organization running the report does not have access to the index.

Question 81

Which of the following searches will return events contains a tag name Privileged?

Options:

A.

Tag= Priv

B.

Tag= Pri*

C.

Tag= Priv*

D.

Tag= Privileged

Question 82

How does a user display a chart in stack mode?

Options:

A.

By using the stack command.

B.

By turning on the Use Trellis Layout option.

C.

By changing Stack Mode in the Format menu.

D.

You cannot display a chart in stack mode, only a timechart.

Question 83

What does the fillnull command replace null values with, it the value argument is not specified?

Options:

A.

0

B.

N/A

C.

NaN

D.

NULL

Question 84

What is required for a macro to accept three arguments?

Options:

A.

The macro's name ends with (3).

B.

The macro's name starts with (3).

C.

The macro's argument count setting is 3 or more.

D.

Nothing, all macros can accept any number of arguments.

Question 85

When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Options:

A.

Tabs

B.

Pipes

C.

Colons

D.

Spaces

Page: 1 / 29
Total 285 questions