Which of the following examples would use a POST workflow action?

Use the field values in an HTTP error event to create a new ticket in an external system.

Perform an external IP lookup based on a domain value found in events.

Use the field values in an HTTP error event to create a new ticket in an external system.

Launch secondary Splunk searches that use one or more field values from selected events.

Open a web browser to look up an HTTP status code.

Which field will be used to populate the field if the productName and product:d fields have values for a given event?

Both field values will be used and the product INFO field will become a multivalue field for the given event.

| eval productINFO=coalesco(productName,productid)

Both field values will be used and the product INFO field will become a multivalue field for the given event.

The value for the productName field because it appears first.

Neither field value will be used and the field will be assigned a NULL value for the given event.

The value for the field because it appears second.

Which of the following statements would help a user choose between the transaction and stats commands?

There is a 1000 event limitation with the transaction command.

state can only group events using IP addresses.

The transaction command is faster and more efficient.

There is a 1000 event limitation with the transaction command.

Use state when the events need to be viewed as a single event.

When can a pipe follow a macro?

A pipe may always follow a macro.

The current user must own the macro.

The macro must be defined in the current app.

Only when sharing is set to global for the macro.

Which of the following statements describes the use of the Filed Extractor (FX)?

Field extracted using the Extracted persist as knowledge objects.

The Field Extractor automatically extracts all field at search time.

The Field Extractor uses PERL to extract field from the raw events.

Field extracted using the Extracted persist as knowledge objects.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

Which of the following searches would return a report of sales by product-name?

chart sum(price) as sales by product_name

stats sum(price) as sales over product_name

timechart list(sales), values(product_name)

A data model consists of which three types of datasets?

Events, searches, transactions.

Field extraction, regex, delimited.

Transaction, session ID, metadata.

When using the transaction command, what does the argument maxspan do?

Sets the maximum total time between the earliest and latest events in a transaction.

Sets the maximum total time between events in a transaction.

Sets the maximum length of all events within a transaction.

Sets the maximum total time between the earliest and latest events in a transaction.

Sets the maximum length that any single event can reach to be included in the transaction.

Which of the following searches would create a graph similar to the one below?

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

None of these searches would generate a similart graph.

Information needed to create a GET workflow action includes which of the following? (select all that apply.)

A URI where the user will be directed at search time.

A label that will appear in the Event Action menu at search time.

A URI where the user will be directed at search time.

A label that will appear in the Event Action menu at search time.

A name for the URI where the user will be directed at search time.

By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Determined automatically based on the data source.

Determined automatically based on the sourcetype.

Determined automatically based on the data source.

Which of the following statements about tags is true? (select all that apply.)

Tags are based on field/vale pairs.

Tags are designed to make data more understandable.

Tags are based on field/vale pairs.

Tags categorize events based on a search.

Tags are designed to make data more understandable.

What are the expected results for a search that contains the command | where A=B?

Events where values of field are equal to values of field B.

Events that contain the string value where A=B.

Events that contain the string value A=B.

Events where values of field are equal to values of field B.

Events where field A contains the string value B.

When would a user select delimited field extractions using the Field Extractor (FX)?

When a log file has values that are separated by the same character, for example, commas.

When a log file contains empty lines or comments.

With structured files such as JSON or XML.

When the file has a header that might provide information about its structure or format.

A user runs the following search:index---X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother---fWhich of the following table headers match the order this command creates?

Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

The chart command does not allow for multiple statistical functions.

Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase

Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

Count: product, sum: product, count: action, sum: action

Which of the following is true about Pivot?

Users can save reports from Pivot.

Users cannot share visualizations created with Pivot.

Users must use SPL to find events in a Pivot.

Users cannot create visualizations with Pivot.

How is an event type created from the search window? (select all that apply)

In the top right corner, click Save As > Event Type.

Edit eventtypes.conf and add a new stanza.

In the top right corner, click Save As > Event Type.

In an event's detail dropdown, click Event Actions > Build Event Type.

Edit eventtypes.conf and add a new stanza.

Add | eventtype to the SPL and execute the search.

Consider the following search:index=web sourcetype=access_corabinedThe log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a group.From the following list, which search groups events by jSSESSIONID?

index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267

index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID

index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267

index=web sourcetype=access_combined JSESSTONID <SD42K101O2F267>

Which of the following is true about the Splunk Common Information Model (CIM)?

The data models included in the CIM are configured with data model acceleration turned on.

The data models included in the CIM are configured with data model acceleration turned off.

The CIM contains 28 pre-configured datasets.

The CIM is an app that needs to run on the indexer.

The data models included in the CIM are configured with data model acceleration turned on.

When defining a macro, what are the required elements?

Name and a validation error message.

Which of the following expressions could be used to create a calculated field called gigabytes?

| eval negabytes=sc_bytes(1024/1024)

Tags can reference which of the following knowledge objects?

Extracted fields, field aliases, calculated fields, lookups, and event types.

Tags cannot reference any of these knowledge objects because tags are the last knowledge objects generated in the search-time operation sequence.

Extracted fields, calculated fields, and field aliases only.

If a calculated field has the same name as an extracted field, what happens to the extracted field?

The calculated field will override the extracted field.

The calculated and extracted fields will be combined.

The calculated field will duplicate the extracted field.

An error will be returned and the search will fail.

Given the following eval statement:...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, 'NO-VALUE', fieid2)Which of the following is the equivalent using f ilinull?

... t filinull values=(0,'NO-VALUE') fields=(fieldl,field2)

There is no equivalent expression using f ilinull

... t filinull values=(0,'NO-VALUE') fields=(fieldl,field2)

... I filinull value=0 fieldl I fillnull fields

... I fillnull fieldl I filinull value='NO-VALUE' field2

Why are tags useful in Splunk?

Tags group related data together.

Tags look for less specific data.

Tags visualize data with graphs and charts.

Tags group related data together.

Tags add fields to the raw event data.

To create a tag, which of the following conditions must be met by the user?

Must have the tag capability associated with their user role.

Identify at least one field:value pair.

Have the Power role at a minimum.

Be able to edit the sourcetype the tag applies to.

Must have the tag capability associated with their user role.

When would transaction be used instead of stats?

To group events based on start/end values.

To group events based on a single field value.

To see results of a calculation.

To have a faster and more efficient search.

To group events based on start/end values.

Which of the following is true about a datamodel that has been accelerated?

They can be used with Pivot, the | tstats command, or the | datamodel command.

They can still be used in the Pivot tool but only with the accelerate_pivot capability.

They can no longer be used in the Pivot tool.

They can be used with the |tstats command, but will only return that data which has been accelerated.

Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?

Search and reporting user manual.

Datamodel command reference guide.

Which of the following is true about data model attributes?

They can be added to a dataset from search time field extractions.

They cannot be created within the data model.

They can only be added into a root search dataset.

They cannot be edited if inherited from a parent dataset.

They can be added to a dataset from search time field extractions.

Splunk SPLK-1002 Practice Test 6 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Splunk SPLK-1002 Practice Test 6

Question

Splunk SPLK-1002 Practice Tests

Practice Tests