SPLK-1002 practice questions 101–110

1. Question 101 · 226 in bank

   Which of the following is true about the Splunk Common Information Model (CIM)?

   • AThe CIM contains 28 pre-configured datasets.
   • BThe data models included in the CIM are configured with data model acceleration turned on.
   • CThe data models included in the CIM are configured with data model acceleration turned off.
   • DThe CIM is an app that needs to run on the indexer.

   Show answer

   Answer: C

   Next question

2. Question 102 · 226 in bank

   Consider the following search run over a time range of last 7 days: index=web sourcetype=access_combined | timechart avg(bytes) by product_name Which option is used to change the default time span so that results are grouped into 12 hour intervals?

   • Atimespan=12
   • Bspan=12h
   • Ctimespan=12h
   • Dspan=12

   Show answer

   Answer: B

   Next question

3. Question 103 · 226 in bank

   When would transaction be used instead of stats?

   • ATo have a faster and more efficient search.
   • BTo see results of a calculation.
   • CTo group events based on start/end values.
   • DTo group events based on a single field value.

   Show answer

   Answer: C

   Next question

4. Question 104 · 226 in bank

   Given the following eval statement: ... | eval field1 = if(isnotnull(fieid1),field1,0), field2 = if(isnull<field2), "NO-VALUE", field2) Which of the following is the equivalent using fillnull?

   • AThere is no equivalent expression using fillnull
   • B... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)
   • C... | fillnull field1|' fillnull value="NO-VALUE" field2
   • D... | fillnull value=0 field1 | fillnull field2

   Show answer

   Answer: C

   Next question

5. Question 105 · 226 in bank

   The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?

   • ASaved searches
   • BLookups
   • CKV Store
   • DData models

   Show answer

   Answer: D

   Next question

6. Question 106 · 226 in bank

   How is a Search Workflow Action configured to run at the same time range as the original search?

   • ASelect the "Use the same time range as the search that created the field listing" checkbox.
   • BSet the earliest time to match the original search.
   • CSelect the same time range from the time-range picker.
   • DSelect the "Overwrite time range with the original search" checkbox.

   Show answer

   Answer: A

   Next question

7. Question 107 · 226 in bank

   A calculated field is a shortcut for performing repetitive, long, or complex transformations using which of the following commands?

   • Atransaction
   • Beval
   • Clookup
   • Dstats

   Show answer

   Answer: B

   Next question

8. Question 108 · 226 in bank

   When using the transaction command, how are evicted transactions identified?

   • A_txn field is set to 1, or true.
   • Bopen_txn field is set to l, or true.
   • Cmax_txn field is set to 0, or false.
   • Dclosed_txn field is set to 0, or false.

   Show answer

   Answer: D

   Next question

9. Question 109 · 226 in bank

   How are arguments defined within the macro search string?

   • A“arg”
   • B%arg%
   • C$arg$
   • D‘arg’

   Show answer

   Answer: C

   Next question

10. Question 110 · 226 in bank

    Which of the following objects can a calculated field use as a source?

    • AAn alias of a field.
    • BA field added by an automatic lookup.
    • CThe tag field.
    • DThe eventtype field.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 101. 226 questions available.