Latest [Sep 17, 2021] SPLK-1002 Exam with Accurate Splunk Core Certified Power User Exam PDF Questions
Take a Leap Forward in Your Career by Earning Splunk 179 Questions
NEW QUESTION 67
Which of the following statements describes POST workflow actions?
- A. By default, POST workflow action are shown in both the event and field menus.
- B. POST workflow actions can be configured to send email to the URI location.
- C. Configuration of a POST workflow action includes choosing a sourcetype.
- D. POST workflow actions can be configured to send POST arguments to the URI location.
Answer: D
NEW QUESTION 68
Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?
- A. Workflow actions
- B. Field extractions
- C. Lookups
- D. Macros
Answer: C
Explanation:
Explanation
Normalize your data for each of these fields using a combination of field aliases, field extractions, and lookups.
https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
NEW QUESTION 69
By default, all users have DELETE permission to ALL knowledge objects.
- A. False
- B. True
Answer: A
NEW QUESTION 70
After manually editing; a regular expression (regex), which of the following statements is true?
- A. The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.
- B. Changes made manually can be reverted in the Field Extractor (FX) UI.
- C. It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.
- D. It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.
Answer: C
NEW QUESTION 71
Which of the following searches show a valid use of macro? (Select all that apply)
- A. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
- B. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
- C. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
- D. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
Answer: C,D
Explanation:
Reference:https://answers.splunk.com/answers/574643/field-showing-an-additional-and-not-visible-value-1.html
NEW QUESTION 72
Which workflow action method can be used when the action type is set to link?
- A. GET
- B. UPDATE
- C. Search
- D. PUT
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/SetupaGETworkflowaction
NEW QUESTION 73
Data model fields can be added using the Auto-Extracted method.
Which of the following statements describe Auto-Extracted fields? (Choose all that apply.)
- A. Auto-Extracted fields can be hidden in Pivot.
- B. Auto-Extracted fields can have their data type changed.
- C. Auto-Extracted fields can be added if they already exist in the dataset with constraints.
- D. Auto-Extracted fields can be given a friendly name for use in Pivot.
Answer: B
NEW QUESTION 74
Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s
- A. The first and last events are no more than 30 seconds apart.
- B. The first and last events are no more than 5 seconds apart.
- C. Events in the transaction occurred within 5 seconds.
- D. It groups events that share the same clientip and host.
Answer: D
NEW QUESTION 75
The iplocation and geostats command can be used together.
- A. True
- B. False
Answer: A
NEW QUESTION 76
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
- A. Fields and event category tags
- B. Automatic data model acceleration
- C. Custom visualizations
- D. Pre-configured data models
Answer: A,D
NEW QUESTION 77
Field discovery occurs at ___________ time.
- A. index
- B. search
Answer: B
NEW QUESTION 78
Which statement is true?
- A. Pivot is used for creating datasets.
- B. Data models are randomly structured datasets.
- C. Pivot is used for creating reports and dashboards.
- D. In most cases, each Splunk user will create their own data model.
Answer: C
NEW QUESTION 79
What does the following search do?
- A. Creates a table of the total count of users and split by corndogs.
- B. Creates a table that groups the total number of users by vegetarian corndogs.
- C. Creates a table with the count of all types of corndogs eaten split by user.
- D. Creates a table of the total count of mysterymeat corndogs split by user.
Answer: D
NEW QUESTION 80
These kinds of charts represent a series in a single bar with multiple sections
- A. Split-Series
- B. Multi-Series
- C. Omit nulls
- D. Stacked
Answer: D
NEW QUESTION 81
Which of the following searches will return events contains a tag name Privileged?
- A. Tag= Priv
- B. Tag= Privileged
- C. Tag= Priv*
- D. Tag= Priv*
Answer: B
Explanation:
Reference:
https://docs.splunk.com/Documentation/PCI/4.1.0/Install/PrivilegedUserActivity
NEW QUESTION 82
Which of the following searches would create a graph similar to the one below?
- A. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time
- B. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states
- C. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status
- D. None of these searches would generate a similart graph.
Answer: C
NEW QUESTION 83
Which of the following statements describes the use of the Field Extractor (FX)?
- A. Fields extracted using the Field Extractor persist as knowledge objects.
- B. Fields extracted using the Field Extractor do not persist and must be defined for each search.
- C. The Field Extractor uses PERL to extract fields from the raw events.
- D. The Field Extractor automatically extracts all fields at search time.
Answer: A
NEW QUESTION 84
Which of the following statements describe the Common Information Model (CIM)? (select all that apply)
- A. CIM is an app that can coexist with other apps on a single Splunk deployment.
- B. CIM is a methodology for normalizing data.
- C. The Knowledge Manager uses the CIM to create knowledge objects.
- D. CIM can correlate data from different sources.
Answer: B,C,D
NEW QUESTION 85
Which of the following statements describe the Common Information Model (QM)? (select all that apply)
- A. CIM is ^n app that can coexist with other apps on a single Splunk deployment.
- B. CIM can correlate data from different sources.
- C. CIM is a methodology for normalizing data.
- D. The Knowledge Manager uses the CIM to create knowledge objects.
Answer: C,D
NEW QUESTION 86
Which search mode automatically decides how to return fields based on your search?
- A. Smart mode
- B. Fast mode
- C. Verbose mode
Answer: A
NEW QUESTION 87
Which of the following statements describe the search string below?
dacamodel Application_State All_Application_State search
- A. No events will be returned because the pipe should occur after the datamodel command
- B. Events will be returned from the data model named All_Application_state.
- C. Events will be returned from dataset named Application_state.
- D. Events will be returned from the data model named Application_State.
Answer: B
NEW QUESTION 88
Which of the following searches would create a graph similar to the one below?
- A. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time
- B. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states
- C. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status
- D. None of these searches would generate a similart graph.
Answer: B
NEW QUESTION 89
Which of the following statements would help a user choose between the transaction and stats commands?
- A. Use state when the events need to be viewed as a single event.
- B. There is a 1000 event limitation with the transaction command.
- C. state can only group events using IP addresses.
- D. The transaction command is faster and more efficient.
Answer: B
NEW QUESTION 90
......
Authentic Best resources for SPLK-1002 Online Practice Exam: https://www.trainingquiz.com/SPLK-1002-practice-quiz.html
Practice To SPLK-1002 - TrainingQuiz Remarkable Practice On your Splunk Core Certified Power User Exam Exam: https://drive.google.com/open?id=1KFj-kFCQwsEDiiPg7efDha_DSzKVdAA4
