SPLK-1002 practice questions 121–130

1. Question 121 · 226 in bank

   For the following search, which field populates the x-axis? index=security sourcetype=linux_secure | timechart count by action

   • A_time
   • Bsourcetype
   • Caction
   • Dtime

   Show answer

   Answer: A

   Next question

2. Question 122 · 226 in bank

   Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

   • AEvent types
   • BTags
   • CField alias
   • DSearch workflow action

   Show answer

   Answer: C

   Next question

3. Question 123 · 226 in bank

   Which of the following transforming commands can be used with transactions?

   • Achart, timechart, stats, eventstats
   • Bchart, timechart, stats, diff
   • Cchart, timechart, stats, pivot
   • Dchart, timechart, datamodel, pivot

   Show answer

   Answer: A

   Next question

4. Question 124 · 226 in bank

   What is the correct format for naming a macro with multiple arguments?

   • Amonthly_sales[3]
   • Bmonthly_sales(3)
   • Cmonthly_sales(argument 1, argument 2, argument 3)
   • Dmonthly_sales[argument 1, argument 2, argument 3]

   Show answer

   Answer: B

   Next question

5. Question 125 · 226 in bank

   What are search macros?

   • AA method to normalize fields.
   • BLookup definitions in lookup tables.
   • CCategories of search results.
   • DReusable pieces of search processing language.

   Show answer

   Answer: D

   Next question

6. Question 126 · 226 in bank

   How is a macro referenced in a search?

   • ABy using the macroname command.
   • BBy enclosing the macro name in single-quote characters (').
   • CBy using the macro command.
   • DBy enclosing the macro name in backtick characters (').

   Show answer

   Answer: D

   Next question

7. Question 127 · 226 in bank

   Which search string would only return results for an event type called successful_purchases?

   • Asuccessful_purchases
   • BEvent_Type::successful_purchases
   • Ctag=successful_purchases
   • Deventtype=successful_purchases

   Show answer

   Answer: D

   Next question

8. Question 128 · 226 in bank

   In the Field Extractor, when would the regular expression method be used?

   • AWhen events contain table-based data.
   • BWhen events contain comma-separated data.
   • CWhen events contain JSON data.
   • DWhen events contain unstructured data.

   Show answer

   Answer: D

   Next question

9. Question 129 · 226 in bank

   Which of the following is true about data model attributes?

   • AThey can only be added into a root search dataset.
   • BThey cannot be created within the data model.
   • CThey can be added to a dataset from search time field extractions.
   • DThey cannot be edited if inherited from a parent dataset.

   Show answer

   Answer: C

   Next question

10. Question 130 · 226 in bank

    How is a variable for a macro defined?

    • APlace the variable name inside of percentage signs: %variable name%.
    • BPlace the variable name inside of curly braces: {variable name}.
    • CPlace the variable name inside of dollar signs: $variable name$.
    • DPlace the variable name inside of asterisks: *variable name*.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 121. 226 questions available.