SPLK-1002 Practice Exam — 231 Free Splunk Questions

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

231Practice Questions

3Study Modes

Free

TopicSort

Question 1

Creating and Using Macros

How is a macro referenced in a search?

A By using the macroname command.
B By enclosing the macro name in single-quote characters (').
C By using the macro command.
D By enclosing the macro name in backtick characters (').

Question 2

Creating Field Aliases and Calculated Fields

Question 3

Using the Common Information Model (CIM) Add-On

Question 4

Filtering and Formatting Results

Question 5

Using the Common Information Model (CIM) Add-On

Question 6

Correlating Events

Question 7

Creating and Managing Fields

Question 8

Creating Field Aliases and Calculated Fields

Question 9

Correlating Events

Question 10

Using Transforming Commands for Visualizations

Question 11

Creating and Using Macros

Question 12

Creating and Using Workflow Actions

Question 13

Creating and Using Macros

Question 14

Creating and Using Workflow Actions

Question 15

Creating Data Models

Question 16

Using Transforming Commands for Visualizations

Question 17

Using Transforming Commands for Visualizations

Question 18

Creating Field Aliases and Calculated Fields

Question 19

Creating Tags and Event Types

Question 20

Creating Tags and Event Types

Question 21

Creating and Managing Fields

Question 22

Creating Field Aliases and Calculated Fields

Question 23

Creating and Using Workflow Actions

Question 24

Creating Field Aliases and Calculated Fields

Question 25

Creating Data Models

Page 1 of 10 • Questions 1-25 of 231

1 2 3 4 5

→

Know a question that should be here? Contribute to this exam

Which of the following actions can the eval command perform?

A Remove fields from results.
B Create or replace an existing field.
C Group transactions by one or more fields.
D Save SPL commands to be reused in other searches.

Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)

A CIM is a methodology for normalizing data.
B CIM can correlate data from different sources.
C The Knowledge Manager uses the CIM to create knowledge objects.
D CIM is an app that can coexist with other apps on a single Splunk deployment.

Which one of the following statements about the search command is true?

A It does not allow the use of wildcards.
B It treats field values in a case-sensitive manner.
C It can only be used at the beginning of the search pipeline.
D It behaves exactly like search strings before the first pipe.

By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

A Turned off.
B Turned on.
C Determined automatically based on the sourcetype.
D Determined automatically based on the data source.

Question 6

Correlating Events

Question 7

Creating and Managing Fields

Question 8

Creating Field Aliases and Calculated Fields

Question 9

Correlating Events

Question 10

Using Transforming Commands for Visualizations

Question 11

Creating and Using Macros

Question 12

Creating and Using Workflow Actions

Question 13

Creating and Using Macros

Question 14

Creating and Using Workflow Actions

Question 15

Creating Data Models

Question 16

Using Transforming Commands for Visualizations

Question 17

Using Transforming Commands for Visualizations

Question 18

Creating Field Aliases and Calculated Fields

Question 19

Creating Tags and Event Types

Question 20

Creating Tags and Event Types

Question 21

Creating and Managing Fields

Question 22

Creating Field Aliases and Calculated Fields

Question 23

Creating and Using Workflow Actions

Question 24

Creating Field Aliases and Calculated Fields

Question 25

Creating Data Models

What do events in a transaction have in common?

A All events in a transaction must have the same timestamp.
B All events in a transaction must have the same sourcetype.
C All events in a transaction must have the exact same set of fields.
D All events in a transaction must be related by one or more fields.

Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)

A Tabs
B Pipes
C Spaces
D Commas

Which of the following statements describe calculated fields? (Choose all that apply.)

A Calculated fields can be used in the search bar.
B Calculated fields can be based on an extracted field.
C Calculated fields can only be applied to host and sourcetype.
D Calculated fields are shortcuts for performing calculations using the eval command.

When should transaction be used?

A Only in a large distributed Splunk environment.
B When calculating results from one or more fields.
C When event grouping is based on start/end values.
D When grouping events results in over 1000 events in each group.

When using | timechart by host, which field is represented in the x-axis?

A date
B host
C time
D _time

What is required for a macro to accept three arguments?

A The macro's name ends with (3).
B The macro's name starts with (3).
C The macro's argument count setting is 3 or more.
D Nothing, all macros can accept any number of arguments.

Which workflow action method can be used when the action type is set to link?

A GET
B PUT
C Search
D UPDATE

Which of the following statements about macros is true? (Choose all that apply.)

A Arguments are defined at execution time.
B Arguments are defined when the macro is created.
C Argument values are used to resolve the search string at execution time.
D Argument values are used to resolve the search string when the macro is created.

Information needed to create a GET workflow action includes which of the following? (Choose all that apply.)

A A name for the workflow action.
B A URI where the user will be directed at search time.
C A label that will appear in the Event Action menu at search time.
D A name for the URI where the user will be directed at search time.

Which of the following statements describe data model acceleration? (Choose all that apply.)

A Root events cannot be accelerated.
B Accelerated data models cannot be edited.
C Private data models cannot be accelerated.
D You must have administrative permissions or the accelerate_datamodel capability to accelerate a data model.

How does a user display a chart in stack mode?

A By using the stack command.
B By turning on the Use Trellis Layout option.
C By changing Stack Mode in the Format menu.
D You cannot display a chart in stack mode, only a timechart.

What other syntax will produce exactly the same results as | chart count over vendor_action by user?

A | chart count by vendor_action, user
B | chart count over vendor_action, user
C | chart count by vendor_action over user
D | chart count over user by vendor_action

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.
Which field name appears in the results?

A Both will appear in the All Fields list, but only if the alias is specified in the search.
B Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
C The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
D The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

In which of the following scenarios is an event type more effective than a saved search?

A When a search should always include the same time range.
B When a search needs to be added to other users' dashboards.
C When the search string needs to be used in future searches.
D When formatting needs to be included with the search string.

Which of the following statements about event types is true? (Choose all that apply.)

A Event types can be tagged.
B Event types must include a time range.
C Event types categorize events based on a search.
D Event types can be a useful method for capturing and sharing knowledge.

Which of the following statements describes the use of the Field Extractor (FX)?

A The Field Extractor automatically extracts all fields at search time.
B The Field Extractor uses PERL to extract fields from the raw events.
C Fields extracted using the Field Extractor persist as knowledge objects.
D Fields extracted using the Field Extractor do not persist and must be defined for each search.

A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

A It doesn't matter whether eval or sort is used first.
B Convert the numeric to a string with eval first, then sort.
C Use sort first, then convert the numeric to a string with eval.
D You cannot use the sort command and the eval command on the same field.

In what order are the following knowledge objects/configurations applied?

A Field Aliases, Field Extractions, Lookups
B Field Extractions, Field Aliases, Lookups
C Field Extractions, Lookups, Field Aliases
D Lookups, Field Aliases, Field Extractions

Which of the following statements describes field aliases?

A Field alias names replace the original field name.
B Field aliases can be used in lookup file definitions.
C Field aliases only normalize data across sources and sourcetypes.
D Field alias names are not case sensitive when used as part of a search.

Which of the following is the correct way to use the datamodel command to search fields in the Web data model within the Web dataset?

A | datamodel Web Web search | fields Web*
B | search datamodel Web Web | fields Web*
C | datamodel Web Web fields | search Web*
D datamodel=Web | search Web | fields Web*

Join Us Among the Stars

SPLK-1002Preview

About the SPLK-1002 Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25