[Jan 02, 2022] Pass Splunk Core Certified Power User SPLK-1002 Exam With 179 Questions
Ultimate Guide to Prepare Free Splunk SPLK-1002 Exam Questions & Answer
NEW QUESTION 44
Which of the following searches will return events containing a tag named Privileged?
- A. tag=Priv*
- B. tag=Priv
- C. tag=priv*
- D. tag=privileged
Answer: A
NEW QUESTION 45
Which of the following statements describes the use of the Filed Extractor (FX)?
- A. Field extracted using the Extracted persist as knowledge objects.
- B. The Field Extractor uses PERL to extract field from the raw events.
- C. The Field Extractor automatically extracts all field at search time.
- D. Fields extracted using the Field Extractor do not persist and must be defined for each search.
Answer: A
NEW QUESTION 46
When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?
- A. The regex can no longer be edited.
- B. Only events with the required string will be included in the extraction.
- C. The field being extracted will be required for all future events.
- D. The events without the required field will not display in searches.
Answer: B
NEW QUESTION 47
When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied.
(Select all that apply).
- A. NOT
- B. AND
- C. OR
- D. ( )
Answer: D
NEW QUESTION 48
It is mandatory for the lookup file to have this for an automatic lookup to work.
- A. Input filed
- B. Timestamp
- C. Source type
- D. At least five columns
Answer: A
NEW QUESTION 49
Which group of users would most likely use pivots?
- A. Administrators
- B. Architects
- C. Knowledge Managers
- D. Users
Answer: C
NEW QUESTION 50
Which workflow uses field values to perform a secondary search?
- A. Action
- B. Sub-Search
- C. POST
- D. Search
Answer: D
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/CreateworkflowactionsinSplunkWeb
NEW QUESTION 51
Scheduled alerts must be scheduled to run with cron job syntax only.
- A. True
- B. False
Answer: B
NEW QUESTION 52
Data model are composed of one or more of which of the following datasets? (select all that apply.)
- A. Search datasets
- B. Events datasets
- C. Any child of event, transaction, and search datasets
- D. Transaction datasets
Answer: A,B,D
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels
NEW QUESTION 53
Which group of users would most likely use pivots?
- A. Administrators
- B. Knowledge Managers
- C. Architects
- D. Users
Answer: D
Explanation:
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Pivot/IntroductiontoPivot
NEW QUESTION 54
Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)
- A. Database
- B. User permissions
- C. Alerts
- D. Email
Answer: A,C,D
NEW QUESTION 55
Based on the macro definition shown below, what is the correct way to execute the macro in a search string?
- A. Convert_sales (euro, €, 79)"
- B. Convert_sales ($euro,$€$,s79$
- C. Convert_sales (euro, €, .79)
- D. Convert_sales ($euro, $€$,S,79$)
Answer: D
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros
NEW QUESTION 56
What does the following search do?
- A. Creates a table of the total count of users and split by corndogs.
- B. Creates a table that groups the total number of users by vegetarian corndogs.
- C. Creates a table of the total count of mysterymeat corndogs split by user.
- D. Creates a table with the count of all types of corndogs eaten split by user.
Answer: C
NEW QUESTION 57
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)
- A. Spaces
- B. Colons
- C. Tabs
- D. Pipes
Answer: A,C,D
Explanation:
Reference:
https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Separate-on-Colon/m-p/29751
NEW QUESTION 58
Which one of the following statements about the search command is true?
- A. It does not allow the use of wildcards.
- B. It treats field values in a case-sensitive manner.
- C. It behaves exactly like search strings before the first pipe.
- D. It can only be used at the beginning of the search pipeline.
Answer: C
Explanation:
Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Search/Usethesearchcommand
NEW QUESTION 59
Which of the following commands will show the maximum bytes?
- A. sourcetype=access_* | maximum totals by bytes
- B. sourcetype=access_* | max(bytes)
- C. sourcetype=access_* | stats max(bytes)
- D. sourcetype=access_* | avg (bytes)
Answer: C
NEW QUESTION 60
Which delimiters can the Field Extractor (FX) detect? (select all that apply)
- A. Spaces
- B. Commas
- C. Tabs
- D. Pipes
Answer: A,B,C,D
NEW QUESTION 61
Calculated fields can be based on which of the following?
- A. Fields generated from a search string
- B. Extracted fields
- C. Tags
- D. Output fields for a lookup
Answer: B
Explanation:
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields
NEW QUESTION 62
Which of the following statements about event types is true? (select all that apply)
- A. Event types can be tagged.
- B. Event types must include a time range,
- C. Event types categorize events based on a search.
- D. Event types can be a useful method for capturing and sharing knowledge.
Answer: A,C,D
Explanation:
Reference:https://www.edureka.co/blog/splunk-events-event-types-and-tags/
NEW QUESTION 63
Historical searches provide a static snapshot of events at a given time.
- A. True
- B. False
Answer: A
NEW QUESTION 64
Which Knowledge Object does the Splunk Common Information Model (CIM) use to normalize data, in addition to field aliases, event types, and tags?
- A. Workflow actions
- B. Macros
- C. Field extractions
- D. Lookups
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
NEW QUESTION 65
Which of the following statements describe data model acceleration? (select all that apply)
- A. Root events cannot be accelerated.
- B. You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.
- C. Private data models cannot be accelerated.
- D. Accelerated data models cannot be edited.
Answer: B,C,D
NEW QUESTION 66
When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied. (Select all that apply).
- A. NOT
- B. AND
- C. OR
- D. ( )
Answer: D
NEW QUESTION 67
All users by default have WRITE permission to ALL knowledge objects.
- A. True
- B. False
Answer: B
NEW QUESTION 68
Which of the following searches will return events contains a tag name Privileged?
- A. Tag= Priv*
- B. Tag= Privileged
- C. Tag= Priv
- D. Tag= Priv*
Answer: B
Explanation:
Reference:
https://docs.splunk.com/Documentation/PCI/4.1.0/Install/PrivilegedUserActivity
NEW QUESTION 69
......
Splunk Core Certified Power User Exam Practice Tests 2022 | Pass SPLK-1002 with confidence!: https://drive.google.com/open?id=1LHtJIq_izMXLfe21z9qPdsDDPmIcu4gL
Pass SPLK-1002 Tests Engine pdf - All Free Dumps: https://www.prep4pass.com/SPLK-1002_exam-braindumps.html
