SPLK-1002 practice questions 141–150

1. Question 141 · 226 in bank

   Which of the following options will define the first event in a transaction?

   • Awith
   • Bstartswith
   • Cstartingwith
   • Dfirstevent

   Show answer

   Answer: B

   Next question

2. Question 142 · 226 in bank

   What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

   • ARun a search using the authentication command.
   • BConsult the CIM event type reference tables.
   • CConsult the CIM data model reference tables.
   • DRun a search using the correlation command.

   Show answer

   Answer: C

   Next question

3. Question 143 · 226 in bank

   What type of command is eval?

   • ADistributable streaming
   • BReport generating
   • CStreaming in some modes
   • DCentralized streaming

   Show answer

   Answer: A

   Next question

4. Question 144 · 226 in bank

   Which workflow action type performs a secondary search?

   • AGET
   • BPOST
   • CSearch
   • DDrilldown

   Show answer

   Answer: C

   Next question

5. Question 145 · 226 in bank

   How can an existing accelerated data model be edited?

   • AIt cannot be edited. A new data model would need to be created.
   • BThe data model must be de-accelerated before edits can be made to its structure.
   • CAn accelerated data model can be edited once its .tsidx file has expired.
   • DAn accelerated data model can be edited from the Pivot tool.

   Show answer

   Answer: B

   Next question

6. Question 146 · 226 in bank

   Which of the following is true about data sets used in the Pivot tool?

   • AThey can only be created from summary indexes.
   • BThey can only be created by users with the Admin role.
   • CThey can only be created from saved reports.
   • DThey can only be created from data models.

   Show answer

   Answer: D

   Next question

7. Question 147 · 226 in bank

   Which of the following expressions could be used to create a calculated field called megabytes?

   • Aeval sc_bytes(1024/1024)
   • Bsc_bytes(1024/1024)
   • C| eval megabytes=sc_bytes(1024/1024)
   • Dmegabytes=sc_bytes(1024/1024)

   Show answer

   Answer: C

   Next question

8. Question 148 · 226 in bank

   If there are fields in the data with values that are "" or empty but not null, which of the following would add a value?

   • A| eval notNULL="" | fillnull value=0 notNULL
   • B| eval notNULL = "" | nullfill value=0 notNULL
   • C| eval notNULL = if(isnull(notNULL), "0"
   • D| eval notNULL = if(isnull(notNULL), "0", notNULL)

   Show answer

   Answer: A

   Next question

9. Question 149 · 226 in bank

   What commands can be used to group events from one or more data sources?

   • Atop,rare
   • Btransaction,stats
   • Ceval,coalesce
   • Dstats,format

   Show answer

   Answer: B

   Next question

10. Question 150 · 226 in bank

    Which syntax is used to represent an argument in a macro definition?

    • A%argument%
    • B'argument'
    • C"argument"
    • D$argument$

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 141. 226 questions available.