Exam Code: SPLK-1002 (Practice Exam Latest Test Questions VCE PDF)
Exam Name: Splunk Core Certified Power User Exam
Certification Provider: Splunk
Free Today! Guaranteed Training- Pass SPLK-1002 Exam.
Free demo questions for Splunk SPLK-1002 Exam Dumps Below:
NEW QUESTION 1
Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID
- A. An additional filed named maxspan is created.
- B. An additional Held named duration is created.
- C. An additional field named eventcount is created.
- D. Events with the same JSESSIONID will be grouped together into a single event.
Answer: BCD
NEW QUESTION 2
A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?
- A. Both will appear in the All Fields list, but only if the alias is specified in the search.
- B. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
- C. The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
- D. The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.
Answer: B
NEW QUESTION 3
What is required for a macro to accept three arguments?
- A. The macro's name ends with (3).
- B. The macro's name starts with (3).
- C. The macro's argument count setting is 3 or more.
- D. Nothing, all macros can accept any number of arguments.
Answer: A
NEW QUESTION 4
Which of the following eval command function is valid?
- A. Int ()
- B. Count ( )
- C. Print ()
- D. Tostring ()
Answer: D
NEW QUESTION 5
A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?
- A. It doesn't matter whether eval or sort is used first.
- B. Convert the numeric to a string with eval first, then sort.
- C. Use sort first, then convert the numeric to a string with eval.
- D. You cannot use the sort command and the eval command on the same field.
Answer: B
NEW QUESTION 6
Which of the following describes the Splunk Common Information Model (CIM) add-on?
- A. The CIM add-on uses machine learning to normalize data.
- B. The CIM add-on contains dashboards that show how to map data.
- C. The CIM add-on contains data models to help you normalize data.
- D. The CIM add-on is automatically installed in a Splunk environment.
Answer: C
NEW QUESTION 7
Which of the following statements describe calculated fields? (select all that apply)
- A. Calculated fields can be used in the search bar.
- B. Calculated fields can be based on an extracted field.
- C. Calculated fields can only be applied to host and sourcetype.
- D. Calculated fields are shortcuts for performing calculations using the eval command.
Answer: BD
NEW QUESTION 8
Which of the following statements about data models and pivot are true? (select all that apply)
- A. They are both knowledge objects.
- B. Data models are created out of datasets called pivots.
- C. Pivot requires users to input SPL searches on data models.
- D. Pivot allows the creation of data visualizations that present different aspects of a data model.
Answer: BD
NEW QUESTION 9
which of the following are valid options with the chart command
- A. useother
- B. usenull
- C. fillfield
- D. usefiled
Answer: AB
NEW QUESTION 10
Which of the following statements is true, especially in large environments?
- A. Use the scats command when you next to group events by two or more fields.
- B. The stats command is faster and more efficient than the transaction command
- C. The transaction command is faster and more efficient than the stats command.
- D. Use the transaction command when you want to see the results of a calculation.
Answer: B
NEW QUESTION 11
These allow you to categorize events based on search terms. Select your answer.
- A. Groups
- B. Event Types
- C. Macros
- D. Tags
Answer: B
NEW QUESTION 12
Which of the following searches will return events contains a tag name Privileged?
- A. Tag= Priv
- B. Tag= Priv*
- C. Tag= Priv*
- D. Tag= Privileged
Answer: D
NEW QUESTION 13
Splunk alerts can be based on search that run _______. (Select all that apply.)
- A. in real-time
- B. on a regular schedule
- C. and have no matching events
Answer: AB
NEW QUESTION 14
How does a user display a chart in stack mode?
- A. By using the stack command.
- B. By turning on the Use Trellis Layout option.
- C. By changing Stack Mode in the Format menu.
- D. You cannot display a chart in stack mode, only a timechart.
Answer: C
NEW QUESTION 15
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)
- A. Tabs
- B. Pipes
- C. Colons
- D. Spaces
Answer: ABD
NEW QUESTION 16
Using the export function, you can export search results as _______.( Select all that apply)
- A. Xml
- B. Json
- C. Html
- D. A php file
Answer: AB
NEW QUESTION 17
Which of the following are valid options to speed up reports? (Select all the apply.)
- A. Edit permissions
- B. Edit description
- C. Edit acceleration
- D. Edit schedule
Answer: C
NEW QUESTION 18
The eval command 'if' function requires the following three arguments (in order):
- A. Boolean expression, result if true, result if false
- B. Result if true, result if false, boolean expression
- C. Result if false, result if true, boolean expression
- D. Boolean expression, result if false, result if true
Answer: A
NEW QUESTION 19
To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?
- A. Index-main | REJECT trans sessionid
- B. Index-main | transaction sessionid | search REJECT
- C. Index=main | transaction sessionid | whose transaction=reject
- D. Index=main | transaction sessionid | where transaction=reject’’
Answer: D
NEW QUESTION 20
Which of the following statements describes macros?
- A. A macro is a reusable search string that must contain the full search.
- B. A macro is a reusable search string that must have a fixed time range.
- C. A macro Is a reusable search string that may have a flexible time range.
- D. A macro Is a reusable search string that must contain only a portion of the search.
Answer: C
NEW QUESTION 21
When using timechart, how many fields can be listed after a by clause? ( Choose Two )
- A. because timechart doesn't support using a by clause.
- B. because _time is already implied as the x-axis.
- C. because one field would represent the x-axis and the other would represent the y-axis.
- D. There is no limit specific to timechart.
Answer: BD
NEW QUESTION 22
Calculated fields can be based on which of the following?
- A. Tags
- B. Extracted fields
- C. Output fields for a lookup
- D. Fields generated from a search string
Answer: B
NEW QUESTION 23
A calculated field maybe based on which of the following?
- A. Lookup tables
- B. Extracted fields
- C. Regular expressions
- D. Fields generated within a search string
Answer: B
NEW QUESTION 24
......
100% Valid and Newest Version SPLK-1002 Questions & Answers shared by prep-labs.com, Get Full Dumps HERE: https://www.prep-labs.com/dumps/SPLK-1002/ (New 153 Q&As)
