Splunk SPLK-1002 Exam Dumps (V13.02) – The Simplest Way of Splunk Core Certified Power User Exam Preparations

1. Which of the following Statements about macros is true? (select all that apply)

2. What is required for a macro to accept three arguments?

3. Which of the following statements describes POST workflow actions?

4. Which of the following searches show a valid use of macro? (Select all that apply)

5. Which of the following workflow actions can be executed from search results? (select all that apply)

6. Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

7. Which of the following searches will return events contains a tag name Privileged?

8. Which of the following statements describes this search?

sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

9. Calculated fields can be based on which of the following?

10. Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

11. When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

12. Which of the following statements describes the command below (select all that apply)

Sourcetype=access_combined | transaction JSESSIONID

13. Which of the following can be used with the eval command tostring function (select all that apply)

14. Which of the following statements about tags is true?

15. Which of the following statements about data models and pivot are true? (select all that apply)

16. When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

17. Which of the following describes the Splunk Common Information Model (CIM) add-on?

18. What does the transaction command do?

19. Which of the following statements describe data model acceleration? (select all that apply)

20. A user wants to convert numeric field values to strings and also to sort on those values.

Which command should be used first, the eval or the sort?

21. The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization.

If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

22. Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

23. A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.

Which field name appears in the results?

24. When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

25. Which group of users would most likely use pivots?

26. When using timechart, how many fields can be listed after a by clause?

27. What is the correct syntax to search for a tag associated with a value on a specific fields?

28. What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

29. When should you use the transaction command instead of the scats command?

30. Which of the following statements describes field aliases?

31. What does the following search do?

32. Which of the following statements describes Search workflow actions?

33. What do events in a transaction have In common?

34. Which of the following statements describe GET workflow actions?

35. Data model are composed of one or more of which of the following datasets? (select all that apply.)

36. Which are valid ways to create an event type? (select all that apply)

37. Which of the following statements describe the search string below?

| datamodel Application_State All_Application_State search

38. What is the relationship between data models and pivots?

39. What are the two parts of a root event dataset?

40. In which of the following scenarios is an event type more effective than a saved search?

41. How does a user display a chart in stack mode?

42. Which of the following statements about event types is true? (select all that apply)

43. In what order arc the following knowledge objects/configurations applied?

44. Which of the following knowledge objects represents the output of an eval expression?

45. A calculated field maybe based on which of the following?

46. Which of the following eval command function is valid?

47. Which one of the following statements about the search command is true?

48. What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

49. Which of the following file formats can be extracted using a delimiter field extraction?

50. Which of the following statements describes macros?

51. Which of the following statements describe calculated fields? (select all that apply)

52. Which delimiters can the Field Extractor (FX) detect? (select all that apply)

53. Which of the following statements is true, especially in large environments?

54. Which of the following are required to create a POST workflow action?

55. Which of the following statements describe the search below? (select all that apply)

Index=main I transaction clientip host maxspan=30s maxpause=5s

56. Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

57. After manually editing; a regular expression (regex), which of the following statements is true?

58. What does the fillnull command replace null values with, it the value argument is not specified?

59. To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

60. Which of the following actions can the eval command perform?

61. Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

62. Data model fields can be added using the Auto-Extracted method.

Which of the following statements describe Auto-Extracted fields? (select all that apply)

63. When creating a Search workflow action, which field is required?

64. Selected fields are displayed ______each event in the search results.

65. A space is an implied _____ in a search string.

66. Which of the following search control will not re-rerun the search? (Select all that apply.)

67. Highlighted search terms indicate _________ search results in Splunk.

68. When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied. (Select all that apply).

69. The time range specified for a historical search defines the ____________ .------questionable on ans

70. Using the export function, you can export search results as __________.( Select all that apply)

71. The fields sidebar does not show________. (Select all that apply.)

72. Splunk alerts can be based on search that run______. (Select all that apply.)

73. Which of the following about reports is/are true?

74. Select this in the fields sidebar to automatically pipe you search results to the rare command

75. A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

76. Which of the following are valid options to speed up reports? (Select all the apply.)

77. Which of the following statements are true for this search? (Select all that apply.)

SEARCH: sourcetype=access* |fields action productld status

78. Use the dedup command to _____.

79. We can use the rename command to _____ (Select all that apply.)

80. The limit attribute will___________.

81. This function of the stats command allows you to identify the number of values a field has.

82. This function of the stats command allows you to return the sample standard deviation of a field.

83. Which of the following commands will show the maximum bytes?

84. Which of the following searches will show the number of categoryld used by each host?

85. This clause is used to group the output of a stats command by a specific name.

86. This function of the stats command allows you to return the middle-most value of field X.

87. When a search returns __________, you can view the results as a list.

88. Clicking a SEGMENT on a chart, ________.

89. Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

90. It is mandatory for the lookup file to have this for an automatic lookup to work.