SPLK-1002 practice questions 111–120

1. Question 111 · 226 in bank

   How are event types different from saved reports?

   • AEvent types can be shared with Splunk users and added to dashboards.
   • BEvent types include formatting of the search results.
   • CEvent types do not include a time range.
   • DEvent types cannot be used to organize data into categories.

   Show answer

   Answer: C

   Next question

2. Question 112 · 226 in bank

   When creating a data model, which root dataset requires at least one constraint?

   • ARoot event dataset
   • BRoot transaction dataset
   • CRoot search dataset
   • DRoot child dataset

   Show answer

   Answer: A

   Next question

3. Question 113 · 226 in bank

   Which search retrieves events with the event type web_errors?

   • Atag=web_errors
   • Beventtype=web_errors
   • Ceventtype(web_errors)
   • Deventtype "web_errors"

   Show answer

   Answer: B

   Next question

4. Question 114 · 226 in bank

   When used with the timechart command, which value of the limit argument returns all values?

   • Alimit=none
   • Blimit=all
   • Climit=0
   • Dlimit=*

   Show answer

   Answer: C

   Next question

5. Question 115 · 226 in bank

   Which of the following statements best describes a macro?

   • AA macro is a method of categorizing events based on a search.
   • BA macro is a knowledge object that enables you to schedule searches for specific events.
   • CA macro is a portion of a search that can be reused in multiple places.
   • DA macro is a way to associate an additional (new) name with an existing field name.

   Show answer

   Answer: C

   Next question

6. Question 116 · 226 in bank

   The macro weekly_sales(2) contains the search string: index=games | eval ProductSales = $Price$ * $AmountSold$ Which of the following will return results?

   • A'weekly_sales(3.99, 10)'
   • B'weekly_sales($3.99$, $10$)'
   • C'weekly_sales(3.99, 10)'
   • D'weekly_sales(3)'

   Show answer

   Answer: C

   Next question

7. Question 117 · 226 in bank

   What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

   • AThere is a limit to the number of fields that can be extracted.
   • BThe user is unable to return to the automatic field extraction workflow.
   • CThe user is unable to preview the extractions.
   • DThe extraction is added at index time.

   Show answer

   Answer: B

   Next question

8. Question 118 · 226 in bank

   What does the fillnull command replace null values with, if the value argument is not specified?

   • ANULL
   • B0
   • CNaN
   • DN/A

   Show answer

   Answer: B

   Next question

9. Question 119 · 226 in bank

   What is the correct syntax for the transaction command?

   • A| transaction(clientip,5m,1m)
   • B| transaction clientip maxspan=5 pause=1
   • C| transaction clientip maxspan=5m maxpause=1m
   • D| transaction(clientip, 5, 1)

   Show answer

   Answer: C

   Next question

10. Question 120 · 226 in bank

    What is the Splunk Common Information Model (CIM)?

    • AThe CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.
    • BThe CIM defines an ecosystem of apps that can be fully supported by Splunk.
    • CThe CIM provides a methodology to normalize data from different sources and source types.
    • DThe CIM is a data exchange initiative between software vendors.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 111. 226 questions available.