Home / Splunk / SPLK-1002

Splunk SPLK-1002 Practice Test - Questions Answers, Page 15

Question list

List of questions

Question 141

(0)

A data model can consist of what three types of datasets?

Question 142

(0)

When is a GET workflow action needed?

Question 143

(0)

Which command can include both an over and a by clause to divide results into sub-groupings?

Question 144

(0)

A user wants to create a new field alias for a field that appears in two sourcetypes. How many field aliases need to be created?

Question 145

(0)

In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, 'OK', status==404, 'Not found', status==500, 'Internal Server

Question 146

(0)

In which Settings section are macros defined?

Question 147

(0)

Which of the following statements describes calculated fields?

Question 148

(0)

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Question 149

(0)

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Question 150

(0)

Consider the following search: Index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the follow

Question 141

A data model can consist of what three types of datasets?

Pivot, searches, and events.

Pivot, events, and transactions.

Searches, transactions, and pivot.

Events, searches, and transactions.

Show Answer Comment (0)

Question 142

When is a GET workflow action needed?

To send field values to an external resource.

To retrieve information from an external resource.

To use field values to perform a secondary search.

To define how events flow from forwarders to indexes.

Show Answer Comment (0)

Question 143

Which command can include both an over and a by clause to divide results into sub-groupings?

chart

stats

xyseries

transaction

Show Answer Comment (0)

Question 144

A user wants to create a new field alias for a field that appears in two sourcetypes.

How many field aliases need to be created?

One.

Two.

It depends on whether the original fields have the same name.

It depends on whether the two sourcetypes are associated with the same index.

Show Answer Comment (0)

In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, 'OK', status==404, 'Not found', status==500, 'Internal Server Error')

The description field would contain no value.

The description field would contain the value 0.

The description field would contain the value 'Internal Server Error'.

This statement would produce an error in Splunk because it is incomplete.

Show Answer Comment (0)

Question 146

In which Settings section are macros defined?

Fields

Tokens

Advanced Search

Searches, Reports, Alerts

Show Answer Comment (0)

Question 147

Which of the following statements describes calculated fields?

Calculated fields are only used on fields added by lookups.

Calculated fields are a shortcut for repetitive and complex eval commands.

Calculated fields are a shortcut for repetitive and complex calc commands.

Calculated fields automatically calculate the simple moving average for indexed fields.

Show Answer Comment (0)

Question 148

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Access

Accounting

Authorization

Authentication

Show Answer Comment (0)

Question 149

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

There is a limit to the number of fields that can be extracted.

The user is unable to preview the extractions.

The extraction is added at index time.

The user is unable to return to the automatic field extraction workflow.

Show Answer Comment (0)

Question 150

Consider the following search:

Index=web sourcetype=access_combined

The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID

index=web sourcetype=access_combined JSESSIONID <SD404K289O2F151>

index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151

index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151

Show Answer Comment (0)

Total 291 questions