Exam Questions and Answers for SPLK-1002 Study Guide Questions and Answers!
Splunk Core Certified Power User Exam Certification Sample Questions and Practice Exam
The Splunk Core Certified Power User SPLK-1002 exam tests the candidate's fundamental comprehension of SPL searching as well as reporting commands. It also assesses one's skills in making tags along with event types, using macros, and creating workflow actions as well as data models. The test also checks if the candidate can utilize the Common Information Model to normalize data using either Splunk Enterprise or Splunk Cloud Platforms. The overall focus of the exam is on the evaluation of the applicants' understanding of the basic Splunk software and the ability to use it effectively. Finally, SPLK-1002 exam is a requirement for professionals intending to go for the Splunk Core Certified Power User certification.
NEW QUESTION 82
In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host
- A. host
- B. count
- C. status
Answer: B
NEW QUESTION 83
What does the fillnull command replace null values with, it the value argument is not specified?
- A. NULL
- B. NaN
- C. N/A
- D. 0
Answer: D
Explanation:
Reference:
https://answers.splunk.com/answers/653427/fillnull-doesnt-work-without-specfying-a-field.html
NEW QUESTION 84
Which of the following searches show a valid use of a macro? (Choose all that apply.)
- A. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
- B. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
- C. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
- D. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
Answer: B,C
NEW QUESTION 85
The limit attribute will___________.
- A. override default of 20
- B. override default of 10
- C. only work with top command
- D. override default of 15
Answer: B
NEW QUESTION 86
Which workflow action method can be used the action type is set to link?
- A. GET
- B. Search
- C. PUT
- D. UPDATE
Answer: A
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps Navigate to Settings > Fields > Workflow Actions.
Click New to open up a new workflow action form.
Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu. Labels can be static or include the value of relevant fields.
Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
Set Action type to link.
In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
Set the Link method to get.
Click Save to save your workflow action definition.
NEW QUESTION 87
To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?
- A. Index=main | transaction sessionid | whose transaction=reject
- B. Index-main | REJECT trans sessionid
- C. Index=main | transaction sessionid | where transaction=reject''
- D. Index-main | transaction sessionid | search REJECT
Answer: A
NEW QUESTION 88
Which of the following searches show a valid use of macro? (Select all that apply)
- A. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
- B. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
- C. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
- D. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
Answer: B,C
NEW QUESTION 89
Which of the following are valid options with the chart command ?(select all that apply)
- A. useother=f
- B. split=t
- C. usenull=f
- D. transcation=t
Answer: C,D
NEW QUESTION 90
Which of the following statements describes POST workflow actions?
- A. Configuration of a POST workflow action includes choosing a sourcetype.
- B. POST workflow actions can be configured to send email to the URI location.
- C. POST workflow actions can be configured to send POST arguments to the URI location.
- D. By default, POST workflow action are shown in both the event and field menus.
Answer: A
NEW QUESTION 91
Which of the following statements is true, especially in large environments?
- A. The stats command is faster and more efficient than the transaction command
- B. Use the scats command when you next to group events by two or more fields.
- C. The transaction command is faster and more efficient than the stats command.
- D. Use the transaction command when you want to see the results of a calculation.
Answer: A
NEW QUESTION 92
The command shown here does witch of the following: Command: |outputlookup products.csv
- A. Returns the contents of a file named products.csv
- B. Writes search results to a file named products.csv
Answer: B
NEW QUESTION 93
Which of the following can be used with the eval command tostring function (select all that apply)
- A. ''Decimal''
- B. ''commas''
- C. ''duration''
- D. ''hex''
Answer: B,C,D
Explanation:
Reference:https://splunkonbigdata.com/2018/10/27/usage-of-splunk-eval-function-tostring/
NEW QUESTION 94
Which of the following statements is true, especially in large environments?
- A. The stats command is faster and more efficient than the transaction command
- B. Use the scats command when you next to group events by two or more fields.
- C. The transaction command is faster and more efficient than the stats command.
- D. Use the transaction command when you want to see the results of a calculation.
Answer: A
Explanation:
Reference:https://answers.splunk.com/answers/103/transaction-vs-stats-commands.html
NEW QUESTION 95
Which of the following searches would create a graph similar to the one below?
- A. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states
- B. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time
- C. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status
- D. None of these searches would generate a similart graph.
Answer: C
NEW QUESTION 96
When should you use the transaction command instead of the scats command?
- A. When duration is irrelevant in search results. .
- B. When you need to group based on start and end constraints.
- C. When you have over 1000 events in a transaction.
- D. When you need to group on multiple values.
Answer: C
NEW QUESTION 97
Which of the following statements is true, especially in largo environments?
- A. The stats command is faster and more efficient than the transaction command
- B. Use the scats command when you next to group events by two or more fields.
- C. The transaction command is faster and more efficient than the stats command.
- D. Use the transaction command when you want to see the results of a calculation.
Answer: A
NEW QUESTION 98
......
Who should take the splk-1002 exam
The Splunk Core Certified Power User splk-1002 Exam certification is an internationally-recognized validation that identifies persons who earn it as possessing skilled as Splunk Core Certified Power Users.
SPLK-1002 certification dumps - Splunk Core Certified Power User SPLK-1002 guides - 100% valid: https://www.braindumpsit.com/SPLK-1002_real-exam.html
100% Pass Your SPLK-1002 at First Attempt with BraindumpsIT: https://drive.google.com/open?id=1x7soSD2VLhtL2H7jpC8hKAQMdwJrs5us