ExamGecko
Home / Splunk / SPLK-1002
Ask Question

Splunk SPLK-1002 Practice Test - Questions Answers, Page 11

Question list
Search

Question 101

Report
Export
Collapse

This is what Splunk uses to categorize the data that is being indexed.

sourcetype
sourcetype
index
index
source
source
host
host
Suggested answer: A
asked 23/09/2024
LAURA Camacho
40 questions

Question 102

Report
Export
Collapse

This is what Splunk uses to categorize the data that is being indexed.

Host
Host
Sourcetype
Sourcetype
Index
Index
Source
Source
Suggested answer: B
asked 23/09/2024
Marco Romani
37 questions

Question 103

Report
Export
Collapse

By default search results are not returned in ________ order.

Chronological
Chronological
Reverser chronological
Reverser chronological
ASCIE
ASCIE
Alphabetical
Alphabetical
Suggested answer: A, D
asked 23/09/2024
krishamrock krishqmrock
34 questions

Question 104

Report
Export
Collapse

The stats command will create a _____________ by default.

Table
Table
Report
Report
Pie chart
Pie chart
Suggested answer: A
asked 23/09/2024
ivaylo Skechleiev
36 questions

Question 105

Report
Export
Collapse

Which is not a comparison operator in Splunk

<=
<=
=
=
!=
!=
>
>
?=
?=
Suggested answer: E

Explanation:

: A comparison operator is a symbol that compares two values and returns a Boolean result (true or false)2.Splunk supports various comparison operators such as <, >, =, !=, <=, >=, IN and LIKE2.However, ?= is not a valid comparison operator in Splunk and will cause a syntax error if used in a search string2. Therefore, option E is correct, while options A, B, C and D are incorrect because they are valid comparison operators in Splunk

asked 23/09/2024
Victor Armando Sánchez
37 questions

Question 106

Report
Export
Collapse

Which of the following is NOT a stats function:

sum
sum
addtotals
addtotals
count
count
avg
avg
Suggested answer: B

Explanation:

The stats command is used to calculate summary statistics for your search results such as count, sum, avg, min, max and more2.The stats command supports various functions that you can use to perform calculations on your fields2.However, addtotals is not a stats function but a separate command that adds a row or column with the total of the values in each group2. Therefore, option B is correct, while options A, C and D are incorrect because they are valid stats functions.

asked 23/09/2024
Darren Bilmen
35 questions

Question 107

Report
Export
Collapse

If a search returns ____________ it can be viewed as a chart.

timestamps
timestamps
statistics
statistics
events
events
keywords
keywords
Suggested answer: B

Explanation:

If a search returns statistics, it can be viewed as a chart2.Statistics are tabular data that show the relationship between two or more fields2.You can create statistics by using commands such as stats, chart or timechart2.You can view statistics as a chart by selecting the Visualization tab in the Search app and choosing a chart type such as column, line or pie2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of data that can be viewed as a chart.

asked 23/09/2024
ayodele fakayode
35 questions

Question 108

Report
Export
Collapse

In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

status
status
host
host
count
count
Suggested answer: C

Explanation:

In this search, count will appear on the y-axis2.This search uses the chart command to create a chart of the count of events over host for events that have status not equal to 2002.The chart command creates a table with one column for each value of the field after the over clause and one row for each value of the field after the by clause (if any)2.The values in the table are calculated by applying the function before the over clause to the events in each group2. In this case, the chart command creates a table with one column for each host and one row for the count of events for each host. The y-axis of the chart shows the values of the count function applied to each host. Therefore, option C is correct, while options A and B are incorrect because they appear on the x-axis or as labels of the chart.

asked 23/09/2024
Mir Ali
42 questions

Question 109

Report
Export
Collapse

The timechart command buckets data in time intervals depending on:

the number of events returned
the number of events returned
the selected time range
the selected time range
the type of visualization selected
the type of visualization selected
Suggested answer: B

Explanation:

The timechart command buckets data in time intervals depending on the selected time range2.The timechart command is similar to the chart command but it automatically groups events into time buckets based on the _time field2. The size of the time buckets depends on the time range that you select for your search. For example, if you select Last 24 hours as your time range, Splunk will use 30-minute buckets for your timechart.If you select Last 7 days as your time range, Splunk will use 4-hour buckets for your timechart2. Therefore, option B is correct, while options A and C are incorrect because they are not factors that affect the size of the time buckets.

asked 23/09/2024
Vidana Weerasinghe
43 questions

Question 110

Report
Export
Collapse

Which of these search strings is NOT valid:

index=web status=50* | chart count over host, status
index=web status=50* | chart count over host, status
index=web status=50* | chart count over host by status
index=web status=50* | chart count over host by status
index=web status=50* | chart count by host, status
index=web status=50* | chart count by host, status
Suggested answer: A

Explanation:

This search string is not valid:index=web status=50* | chart count over host,status2. This search string uses an invalid syntax for the chart command. The chart command requires one field after the over clause and optionally one field after the by clause. However, this search string has two fields after the over clause separated by a comma. This will cause a syntax error and prevent the search from running. Therefore, option A is correct, while options B and C are incorrect because they are valid search strings that use the chart command correctly.

asked 23/09/2024
Rudy Raijmakers
40 questions
Total 291 questions
Go to page: of 30