Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

Splunk SPLK-1002 Splunk Core Certified Power User Exam Exam Practice Test

Page: 1 / 29
Total 294 questions

Splunk Core Certified Power User Exam Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$43.75  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$38.5  $109.99
Question 1

Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

Options:

A.

Macros

B.

Lookups

C.

Workflow actions

D.

Field extractions

Question 2

Which of the following statements describe calculated fields? (select all that apply)

Options:

A.

Calculated fields can be used in the search bar.

B.

Calculated fields can be based on an extracted field.

C.

Calculated fields can only be applied to host and sourcetype.

D.

Calculated fields are shortcuts for performing calculations using the eval command.

Question 3

Which of the following is NOT a stats function:

Options:

A.

sum

B.

addtotals

C.

count

D.

avg

Question 4

Which of the following statements describe the search below? (select all that apply)

Index=main I transaction clientip host maxspan=30s maxpause=5s

Options:

A.

Events in the transaction occurred within 5 seconds.

B.

It groups events that share the same clientip and host.

C.

The first and last events are no more than 5 seconds apart.

D.

The first and last events are no more than 30 seconds apart.

Question 5

What is the relationship between data models and pivots?

Options:

A.

Data models provide the datasets for pivots.

B.

Pivots and data models have no relationship.

C.

Pivots and data models are the same thing.

D.

Pivots provide the datasets for data models.

Question 6

Which of the following are required to create a POST workflow action?

Options:

A.

Label, URI, search string.

B.

XMI attributes, URI, name.

C.

Label, URI, post arguments.

D.

URI, search string, time range picker.

Question 7

Consider the the following search run over a time range of last 7 days:

index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane

Which option is used to change the default time span so that results are grouped into 12 hour intervals?

Options:

A.

span=12h

B.

timespan=12h

C.

span=12

D.

timespan=12

Question 8

A user wants to create a new field alias for a field that appears in two sourcetypes.

How many field aliases need to be created?

Options:

A.

One.

B.

Two.

C.

It depends on whether the original fields have the same name.

D.

It depends on whether the two sourcetypes are associated with the same index.

Question 9

This is what Splunk uses to categorize the data that is being indexed.

Options:

A.

Host

B.

Sourcetype

C.

Index

D.

Source

Question 10

The gauge command:

Options:

A.

creates a single-value visualization

B.

allows you to set colored ranges for a single-value visualization

C.

creates a radial gauge visualization

Question 11

These kinds of charts represent a series in a single bar with multiple sections

Options:

A.

Multi-Series

B.

Split-Series

C.

Omit nulls

D.

Stacked

Question 12

Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

Options:

A.

| where 10yearAnnerversary=Renewal-MonthYear

B.

| where ‘10yearAnnerversary=Renewal-MonthYear

C.

| where 10yearAnnerversary=’Renewal-MonthYear’

D.

| where ‘10yearAnnerversary’=’Renewal-MonthYear’

Question 13

Which is not a comparison operator in Splunk

Options:

A.

<=

B.

=

C.

!=

D.

>

E.

?=

Question 14

Which search commands allow a user to access data model summaries?

Options:

A.

pivot, stats, and datamodel

B.

pivot, tstats, and datamodel

C.

transaction, tstats, and datamodel

D.

stats, tstats, and datamodel

Question 15

What is needed to define a calculated field?

Options:

A.

Eval expression

B.

Data model

C.

Event type

D.

Regular expression

Question 16

Which of the following is true about a datamodel that has been accelerated?

Options:

A.

They can be used with Pivot, the | tstats command, or the | datamodel command.

B.

They can still be used in the Pivot tool but only with the accelerate_pivot capability.

C.

They can no longer be used in the Pivot tool.

D.

They can be used with the |tstats command, but will only return that data which has been accelerated.

Question 17

Consider the following search:

index=web sourcetype=access_corabined

The log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a group.

From the following list, which search groups events by jSSESSIONID?

Options:

A.

index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267

B.

index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID

C.

index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267

D.

index=web sourcetype=access_combined JSESSTONID

Question 18

Which of the following knowledge objects represents the output of an eval expression?

Options:

A.

Eval fields

B.

Calculated fields

C.

Field extractions

D.

Calculated lookups

Question 19

In what order arc the following knowledge objects/configurations applied?

Options:

A.

Field Aliases, Field Extractions, Lookups

B.

Field Extractions, Field Aliases, Lookups

C.

Field Extractions, Lookups, Field Aliases

D.

Lookups, Field Aliases, Field Extractions

Question 20

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Options:

A.

The regex can no longer be edited.

B.

The field being extracted will be required for all future events.

C.

The events without the required field will not display in searches.

D.

Only events with the required string will be included in the extraction.

Question 21

Which one of the following statements about the search command is true?

Options:

A.

It does not allow the use of wildcards.

B.

It treats field values in a case-sensitive manner.

C.

It can only be used at the beginning of the search pipeline.

D.

It behaves exactly like search strings before the first pipe.

Question 22

For the following search, which field populates the x-axis?

index=security sourcetype=linux secure | timechart count by action

Options:

A.

action

B.

source type

C.

_time

D.

time

Question 23

Which of the following statements is true, especially in large environments?

Options:

A.

Use the scats command when you next to group events by two or more fields.

B.

The stats command is faster and more efficient than the transaction command

C.

The transaction command is faster and more efficient than the stats command.

D.

Use the transaction command when you want to see the results of a calculation.

Question 24

How many ways are there to access the Field Extractor Utility?

Options:

A.

3

B.

4

C.

1

D.

5

Question 25

Complete the search, …. | _____ failure>successes

Options:

A.

Search

B.

Where

C.

If

D.

Any of the above

Question 26

What is a benefit of installing the Splunk Common Information Model (CIM) add-on?

Options:

A.

It permits users to create workflow actions to align with industry standards.

B.

It provides users with a standardized set of field names and tags to normalize data.

C.

It allows users to create 3-D models of their data and export these visualizations.

D.

It enables users to itemize their events based on the results of the Search Job Inspector.

Question 27

Select this in the fields sidebar to automatically pipe you search results to the rare command

Options:

A.

events with this field

B.

rare values

C.

top values by time

D.

top values

Question 28

There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

Options:

A.

Event Actions > Extract Fields

B.

Fields sidebar > Extract New Field

C.

Settings > Field Extractions > New Field Extraction

D.

Settings > Field Extractions > Open Field Extraction

Question 29

Which of the following searches will return events containing a tag named Privileged?

Options:

A.

tag=Priv

B.

tag=Priv*

C.

tag=priv*

D.

tag=privileged

Question 30

Which of the following workflow actions can be executed from search results? (select all that apply)

Options:

A.

GET

B.

POST

C.

LOOKUP

D.

Search

Question 31

The timechart command buckets data in time intervals depending on:

Options:

A.

the number of events returned

B.

the selected time range

C.

the type of visualization selected

Question 32

What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Options:

A.

| chart count by vendor_action, user

B.

| chart count over vendor_action, user

C.

| chart count by vendor_action over user

D.

| chart count over user by vendor_action

Question 33

What are the expected search results from executing the following SPL command?

index=network NOT StatusCode=200

Options:

A.

Every event in the network index that does not have a value in this field.

B.

Every event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.

C.

Every event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.

D.

No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.

Question 34

What is the correct format for naming a macro with multiple arguments?

Options:

A.

monthly_sales(argument 1, argument 2, argument 3)

B.

monthly_sales(3)

C.

monthly_sales[3]

D.

monthly_sales[argument 1, argument 2, argument 3)

Question 35

The timechart command is an example of which of the following command types?

Options:

A.

Orchestrating

B.

Transforming

C.

Statistical

D.

Generating

Question 36

A data model can consist of what three types of datasets?

Options:

A.

Pivot, searches, and events.

B.

Pivot, events, and transactions.

C.

Searches, transactions, and pivot.

D.

Events, searches, and transactions.

Question 37

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Options:

A.

There is a limit to the number of fields that can be extracted.

B.

The user is unable to preview the extractions.

C.

The extraction is added at index time.

D.

The user is unable to return to the automatic field extraction workflow.

Question 38

Which of the following statements describes the command below (select all that apply)

Sourcetype=access_combined | transaction JSESSIONID

Options:

A.

An additional filed named maxspan is created.

B.

An additional field named duration is created.

C.

An additional field named eventcount is created.

D.

Events with the same JSESSIONID will be grouped together into a single event.

Question 39

Which of the following statements about tags is true? (select all that apply.)

Options:

A.

Tags are case-insensitive.

B.

Tags are based on field/vale pairs.

C.

Tags categorize events based on a search.

D.

Tags are designed to make data more understandable.

Question 40

By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Options:

A.

Turned off

B.

Turned on

C.

Determined automatically based on the sourcetype.

D.

Determined automatically based on the data source.

Question 41

Which of the following is true about data sets used in the Pivot tool?

Options:

A.

They can only be created from data models.

B.

They can only be created by users with the Admin role.

C.

They can only be created from summary indexes.

D.

They can only be created from saved reports.

Question 42

It is mandatory for the lookup file to have this for an automatic lookup to work.

Options:

A.

Source type

B.

At least five columns

C.

Timestamp

D.

Input filed

Question 43

Why would the following search produce multiple transactions instead of one?

Options:

A.

The maxspan option is not included.

B.

The transaction command has a limit of 1000 events per transaction.

C.

The transaction and commands cannot be used together.

D.

The stats list () function is used.

Question 44

Which of the following statements describe the search string below?

| datamodel Application_State All_Application_State search

Options:

A.

Evenrches would return a report of sales by state.

B.

Events will be returned from the data model named Application_State.

C.

Events will be returned from the data model named All_Application_state.

D.

No events will be returned because the pipe should occur after the datamodel command

Question 45

Consider the following search:

Index=web sourcetype=access_combined

The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Options:

A.

index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID

B.

index=web sourcetype=access_combined JSESSIONID

C.

index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151

D.

index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151

Question 46

Which of the following commands connects an additional table of data directly to the right side of the existing table?

Options:

A.

subsearch

B.

update

C.

appendcols

D.

append

Question 47

When using timechart, how many fields can be listed after a by clause?

Options:

A.

because timechart doesn't support using a by clause.

B.

because _time is already implied as the x-axis.

C.

because one field would represent the x-axis and the other would represent the y-axis.

D.

There is no limit specific to timechart.

Question 48

What do events in a transaction have In common?

Options:

A.

All events In a transaction must have the same timestamp.

B.

All events in a transaction must have the same sourcetype.

C.

All events in a transaction must have the exact same set of fields.

D.

All events in a transaction must be related by one or more fields.

Question 49

Which syntax is used to represent an argument in a macro definition?

Options:

A.

"argument"

B.

%argument%

C.

‘argument’

D.

$argument$

Question 50

When creating a Search workflow action, which field is required?

Options:

A.

Search string

B.

Data model name

C.

Permission setting

D.

An eval statement

Question 51

The eval command allows you to do which of the following? (Choose all that apply.)

Options:

A.

Format values

B.

Convert values

C.

Perform calculations

D.

Use conditional statements

Question 52

Which of the following transforming commands can be used with transactions?

Options:

A.

chart, timechart, stats, eventstats

B.

chart, timechart, stats, diff

C.

chart, timeehart, datamodel, pivot

D.

chart, timecha:t, stats, pivot

Question 53

A data model consists of which three types of datasets?

Options:

A.

Constraint, field, value.

B.

Events, searches, transactions.

C.

Field extraction, regex, delimited.

D.

Transaction, session ID, metadata.

Question 54

Which statement is true?

Options:

A.

Pivot is used for creating datasets.

B.

Data models are randomly structured datasets.

C.

Pivot is used for creating reports and dashboards.

D.

In most cases, each Splunk user will create their own data model.

Question 55

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Options:

A.

Tabs

B.

Pipes

C.

Spaces

D.

Commas

Question 56

Data models are composed of one or more of which of the following datasets? (select all that apply)

Options:

A.

Transaction datasets

B.

Events datasets

C.

Search datasets

D.

Any child of event, transaction, and search datasets

Question 57

Which of the following statements describes the use of the Field Extractor (FX)?

Options:

A.

The Field Extractor automatically extracts all fields at search time.

B.

The Field Extractor uses PERL to extract fields from the raw events.

C.

Fields extracted using the Field Extractor persist as knowledge objects.

D.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

Question 58

Which of the following can a field alias be applied to?

Options:

A.

Tags

B.

Event types

C.

Indexes

D.

Sourcetypes

Question 59

When extracting fields, we may choose to use our own regular expressions

Options:

A.

True

B.

False

Question 60

A Splunk app is configured to extract domain names in web service logs and specify them as a field named domain.

What workflow action would return an external IP lookup for the field named domain?

Options:

A.

POST

B.

PUT

C.

GET

D.

Search

Question 61

Which of the following statements describes POST workflow actions?

Options:

A.

POST workflow actions are always encrypted.

B.

POST workflow actions cannot use field values in their URI.

C.

POST workflow actions cannot be created on custom sourcetypes.

D.

POST workflow actions can open a web page in either the same window or a new .

Question 62

What is the purpose of a calculated field?

Options:

A.

To automatically add fields to the index using an eval expression rather than manually including an eval command.

B.

To manually add and remove fields at search time related to statistical functions.

C.

To automatically add fields at search time using an eval expression rather than manually including an eval command.

D.

To manually add fields at search time and check for syntax errors.

Question 63

When using the transaction command, what is the assigned timestamp for each of the resulting transactions?

Options:

A.

The timestamp of the event search time execution.

B.

The timestamp of the earliest event.

C.

The difference between the earliest and latest event.

D.

The timestamp of the most recent event.

Question 64

Which of these is NOT a field that is automatically created with the transaction command?

Options:

A.

maxcount

B.

duration

C.

eventcount

Question 65

Which of the following searches would return a report of sales by product-name?

Options:

A.

chart sales by product_name

B.

chart sum(price) as sales by product_name

C.

stats sum(price) as sales over product_name

D.

timechart list(sales), values(product_name)

Question 66

When would a user select delimited field extractions using the Field Extractor (FX)?

Options:

A.

When a log file has values that are separated by the same character, for example, commas.

B.

When a log file contains empty lines or comments.

C.

With structured files such as JSON or XML.

D.

When the file has a header that might provide information about its structure or format.

Question 67

Which of the following describes the I transaction command?

Options:

A.

It is an SPL command that groups at least two events together based on shared values in selected fields.

B.

It allows an exchange of data from one Splunk index to another Splunk index.

C.

It is an SPL command that groups events together with shared values in selected fields.

D.

It allows an exchange of data from one Splunk system to another Splunk system.

Question 68

When should you use the transaction command instead of the scats command?

Options:

A.

When you need to group on multiple values.

B.

When duration is irrelevant in search results. .

C.

When you have over 1000 events in a transaction.

D.

When you need to group based on start and end constraints.

Question 69

This function of the stats command allows you to return the sample standard deviation of a field.

Options:

A.

stdev

B.

dev

C.

count deviation

D.

by standarddev

Question 70

Which of the following Statements about macros is true? (select all that apply)

Options:

A.

Arguments are defined at execution time.

B.

Arguments are defined when the macro is created.

C.

Argument values are used to resolve the search string at execution time.

D.

Argument values are used to resolve the search string when the macro is created.

Question 71

What information must be included when using the datamodel command?

Options:

A.

status field

B.

Multiple indexes

C.

Data model field name.

D.

Data model dataset name.

Question 72

When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

Options:

A.

index or source

B.

sourcetype or host

C.

index or sourcetype

D.

sourcetype or source

Question 73

Which of the following statements describes an event type?

Options:

A.

A log level measurement: info, warn, error.

B.

A knowledge object that is applied before fields are extracted.

C.

A field for categorizing events based on a search string.

D.

Either a log, a metric, or a trace.

Question 74

Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

Options:

A.

Field alias

B.

Event types

C.

Search workflow action

D.

Tags

Question 75

When is a GET workflow action needed?

Options:

A.

To send field values to an external resource.

B.

To retrieve information from an external resource.

C.

To use field values to perform a secondary search.

D.

To define how events flow from forwarders to indexes.

Question 76

Which field will be used to populate the field if the productName and product:d fields have values for a given event?

| eval productINFO=coalesco(productName,productid)

Options:

A.

Both field values will be used and the product INFO field will become a multivalue field for the given event.

B.

The value for the productName field because it appears first.

C.

Neither field value will be used and the field will be assigned a NULL value for the given event.

D.

The value for the field because it appears second.

Question 77

The transaction command allows you to __________ events across multiple sources

Options:

A.

duplicate

B.

correlate

C.

persist

D.

tag

Question 78

What are the two parts of a root event dataset?

Options:

A.

Fields and variables.

B.

Fields and attributes.

C.

Constraints and fields.

D.

Constraints and lookups.

Question 79

__________ datasets can be added to root dataset to narrow down the search

Options:

A.

parent

B.

extracted

C.

event

D.

child

Question 80

Which of the following options will define the first event in a transaction?

Options:

A.

startswith

B.

with

C.

startingwith

D.

firstevent

Question 81

How are event types different from saved reports?

Options:

A.

Event types cannot be used to organize data into categories.

B.

Event types include formatting of the search results.

C.

Event types can be shared with Splunk users and added to dashboards.

D.

Event types do not include a time range.

Question 82

Which of the following definitions describes a macro named "samplemacro" that accepts two arguments?

Options:

A.

samplemacro[2]

B.

samplemacro[1,2]

C.

samplemacro(2)

D.

samplemacro(1,2)

Question 83

What fields does the transaction command add to the raw events? (select all that apply)

Options:

A.

count

B.

duration

C.

eventcount

D.

transaction id

Question 84

Which workflow action type performs a secondary search?

Options:

A.

POST

B.

Drilldown

C.

GET

D.

Search

Question 85

Which of the following search control will not re-rerun the search? (Select all that apply.)

Options:

A.

zoom out

B.

selecting a bar on the timeline

C.

deselect

D.

selecting a range of bars on the timelines

Question 86

Selected fields are displayed ______each event in the search results.

Options:

A.

below

B.

interesting fields

C.

other fields

D.

above

Question 87

This is what Splunk uses to categorize the data that is being indexed.

Options:

A.

sourcetype

B.

index

C.

source

D.

host

Question 88

Which are valid ways to create an event type? (select all that apply)

Options:

A.

By using the searchtypes command in the search bar.

B.

By editing the event_type stanza in the props.conf file.

C.

By going to the Settings menu and clicking Event Types > New.

D.

By selecting an event in search results and clicking Event Actions > Build Event Type.

Page: 1 / 29
Total 294 questions