Splunk splk-1002 practice test

Splunk Core Certified Power User Exam

Last exam update: Jul 16 ,2024
Page 1 out of 13. Viewing questions 1-15 out of 181

Question 1

Calculated fields can be based on which of the following?
A. Tags
B. Extracted fields
C. Output fields for a lookup
D. Fields generated from a search string

Mark Question:
Answer:

B
"Calculated fields can reference all types of field extractions and field aliasing, but they cannot
reference lookups, event types, or tags."

Discussions
0 / 1000

Question 2

Which of the following eval command functions is valid?
A. int()
B. count()
C. print()
D. tostring()

Mark Question:
Answer:

D
//docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Discussions
0 / 1000

Question 3

Which of the following statements describes the use of the Field Extractor (FX)?

  • A. The Field Extractor automatically extracts all fields at search time.
  • B. The Field Extractor uses PERL to extract fields from the raw events.
  • C. Fields extracted using the Field Extractor persist as knowledge objects.
  • D. Fields extracted using the Field Extractor do not persist and must be defined for each search.
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

Which of the following searches show a valid use of a macro? (Choose all that apply.)

  • A. index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField
  • B. index=main source=mySource oldField=* | stats if(makeMyField(oldField)) | table _time newField
  • C. index=main source=mySource oldField=* | eval newField=makeMyField(oldField)| table _time newField
  • D. index=main source=mySource oldField=* | "newField(makeMyField(oldField))" | table _time newField
Mark Question:
Answer:

AC

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

What is the correct format for naming a macro with multiple arguments?

  • A. monthly_sales(argument 1, argument 2, argument 3)
  • B. monthly_sales(3)
  • C. monthly_sales[3]
  • D. monthly_sales[argument 1, argument 2, argument 3)
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

Which statement is true?

  • A. Pivot is used for creating datasets.
  • B. Data models are randomly structured datasets.
  • C. Pivot is used for creating reports and dashboards.
  • D. In most cases, each Splunk user will create their own data model.
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

What is the Splunk Common Information Model (CIM)?

  • A. The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.
  • B. The CIM provides a methodology to normalize data from different sources and source types.
  • C. The CIM defines an ecosystem of apps that can be fully supported by Splunk.
  • D. The CIM is a data exchange initiative between software vendors.
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

How is a Search Workflow Action configured to run at the same time range as the original search?

  • A. Set the earliest time to match the original search.
  • B. Select the same time range from the time-range picker.
  • C. Select the "Use the same time range as the search that created the field listing" checkbox.
  • D. Select the "Overwrite time range with the original search" checkbox.
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

What does the fillnull command replace null values with, if the value argument is not specified?

  • A. 0
  • B. N/A
  • C. NaN
  • D. NULL
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

Which of the following searches will return events containing a tag named Privileged?

  • A. tag=Priv
  • C. tag=priv*
  • D. tag=privileged
Mark Question:
Answer:

B

User Votes:
A
50%
C
50%
D
50%
Discussions
vote your answer:
A
C
D
0 / 1000

Question 11

Data models are composed of one or more of which of the following datasets? (select all that apply)
A. Transaction datasets
B. Events datasets
C. Search datasets
D. Any child of event, transaction, and search datasets

Mark Question:
Answer:

ABC
Data model datasets have a hierarchical relationship with each other, meaning they have parent-
child relationships. Data models can contain multiple dataset hierarchies. There are three types of
event, search, and transaction.
Datamodeldataset

Discussions
0 / 1000

Question 12

Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the
events as a group. From the following list, which search groups events by JSESSIONID?

  • A. index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID
  • B. index=web sourcetype=access_combined JSESSIONID <SD404K289O2F151>
  • C. index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151
  • D. index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

What happens when a user edits the regular expression (regex) field extraction generated in the Field
Extractor (FX)?

  • A. There is a limit to the number of fields that can be extracted.
  • B. The user is unable to preview the extractions.
  • C. The extraction is added at index time.
  • D. The user is unable to return to the automatic field extraction workflow.
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

Which of the following is one of the pre-configured data models included in the Splunk Common
Information Model (CIM) add-on?

  • A. Access
  • B. Accounting
  • C. Authorization
  • D. Authentication
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

Which of the following statements describes calculated fields?

  • A. Calculated fields are only used on fields added by lookups.
  • B. Calculated fields are a shortcut for repetitive and complex eval commands.
  • C. Calculated fields are a shortcut for repetitive and complex calc commands.
  • D. Calculated fields automatically calculate the simple moving average for indexed fields.
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2