SPLK-1002 practice questions 91–100

1. Question 91 · 226 in bank

   In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

   • AThe description field would contain no value.
   • BThe description field would contain the value 0.
   • CThe description field would contain the value "Internal Server Error".
   • DThis statement would produce an error in Splunk because it is incomplete.

   Show answer

   Answer: A

   Next question

2. Question 92 · 226 in bank

   In which Settings section are macros defined?

   • AFields
   • BTokens
   • CAdvanced Search
   • DSearches, Reports, Alerts

   Show answer

   Answer: C

   Next question

3. Question 93 · 226 in bank

   Which of the following statements describes calculated fields?

   • ACalculated fields are only used on fields added by lookups.
   • BCalculated fields are a shortcut for repetitive and complex eval commands.
   • CCalculated fields are a shortcut for repetitive and complex calc commands.
   • DCalculated fields automatically calculate the simple moving average for indexed fields.

   Show answer

   Answer: B

   Next question

4. Question 94 · 226 in bank

   Which of the following are required to create a POST workflow action?

   • ALabel, URI, search string.
   • BXML attributes, URI, name.
   • CLabel, URI, post arguments.
   • DURI, search string, time range picker.

   Show answer

   Answer: C

   Next question

5. Question 95 · 226 in bank

   Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

   • AAccess
   • BAccounting
   • CAuthorization
   • DAuthentication

   Show answer

   Answer: D

   Next question

6. Question 96 · 226 in bank

   Select 2

   Which of the following statements describe the search below? (Choose all that apply.) index=main | transaction clientip host maxspan=30s maxpause=5s

   • AEvents in the transaction occurred within 5 seconds.
   • BIt groups events that share the same clientip and host.
   • CThe first and last events are no more than 5 seconds apart.
   • DThe first and last events are no more than 30 seconds apart

   Show answer

   Answer: BD

   Next question

7. Question 97 · 226 in bank

   Consider the following search: index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD421K26502F783). View the events as a group. From the following list, which search groups events by JSESSIONID?

   • Aindex-web sourcetype=access_combined | transaction JSESSIONID | search SD42IK26502F783
   • Bindex-web sourcetype=access_combined | highlight JSESSIONID | search SD421K26502F783
   • Cindex=web sourcetype=access_combined SD42IK26502F783 | table JSESSIONID
   • Dindex=web sourcetype=access_combined JSESSIONID <SD421K26502F783>

   Show answer

   Answer: D

   Next question

8. Question 98 · 226 in bank

   When defining a macro, what are the required elements?

   • AName and a validation error message.
   • BDefinition and arguments.
   • CName and arguments.
   • DName and definition.

   Show answer

   Answer: D

   Next question

9. Question 99 · 226 in bank

   Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?

   • APivot users manual.
   • BSearch and reporting user manual.
   • CCIM Add-on manual.
   • DData model command reference guide.

   Show answer

   Answer: C

   Next question

10. Question 100 · 226 in bank

    What is the correct syntax to find events associated with a tag?

    • Atag:<field>=<value>
    • Btags=<value>
    • Ctags:<field>=<value>
    • Dtag=<value>

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 91. 226 questions available.