SPLK-1002 practice questions 151–160

1. Question 151 · 226 in bank

   Select 2

   When should the regular expression mode of Field Extractor (FX) be used? (Choose all that apply.)

   • AFor unstructured data.
   • BFor data cleanly separated by a space, a comma, or a pipe character.
   • CFor data in a CSV (comma-separated value) file.
   • DFor data with multiple, different characters separating fields.

   Show answer

   Answer: AD

   Next question

2. Question 152 · 226 in bank

   Which of the following examples would use a POST workflow action?

   • AUse the field values in an HTTP error event to create a new ticket in an external system.
   • BOpen a web browser to look up an HTTP status code.
   • CLaunch secondary Splunk searches that use one or more field values from selected events.
   • DPerform an external IP lookup based on a domain value found in events.

   Show answer

   Answer: A

   Next question

3. Question 153 · 226 in bank

   When creating an event type, which is allowed in the search string?

   • AJoins
   • BPipes
   • CSubsearches
   • DTags

   Show answer

   Answer: B

   Next question

4. Question 154 · 226 in bank

   What are the expected results for a search that contains the command | where A=B?

   • AEvents where field A contains the string value B.
   • BEvents that contain the string value A=B.
   • CEvents where values of field A are equal to values of field B.
   • DEvents that contain the string value where A=B.

   Show answer

   Answer: C

   Next question

5. Question 155 · 226 in bank

   Which of these stats commands will show the total bytes for each unique combination of page and server?

   • Aindex=web | stats sum(bytes) BY values(page) values(server)
   • Bindex=web | stats sum(bytes) BY page AND server
   • Cindex=web | stats sum(bytes) BY page BY server
   • Dindex=web | stats sum(bytes) BY page server

   Show answer

   Answer: D

   Next question

6. Question 156 · 226 in bank

   When would a user select delimited field extractions using the Field Extractor (FX)?

   • AWith structured files such as JSON or XML.
   • BWhen the file has a header that might provide information about its structure or format.
   • CWhen a log file has values that are separated by the same character, for example, commas.
   • DWhen a log file contains empty lines or comments.

   Show answer

   Answer: C

   Next question

7. Question 157 · 226 in bank

   To which of the following can a field alias be applied?

   • AA given host, source, or sourcetype.
   • BData found in a lookup table.
   • CEither a calculated field or an extracted field.
   • DOnly one single field in a dataset.

   Show answer

   Answer: A

   Next question

8. Question 158 · 226 in bank

   Which tool uses data models to generate reports and dashboard panels without using SPL?

   • AVisualization tab
   • BPivot
   • CSplunk CIM
   • DDatasets

   Show answer

   Answer: B

   Next question

9. Question 159 · 226 in bank

   A field alias is created where field1 = field2 and the Overwrite Field Values checkbox is selected. What happens if an event only contains values for field1?

   • Afield1 and field2 values are merged.
   • Bfield2 values are removed from the events.
   • Cfield2 values are unchanged.
   • Dfield2 values are replaced with the value of the field1.

   Show answer

   Answer: D

   Next question

10. Question 160 · 226 in bank

    Which of the following is true about a datamodel that has been accelerated?

    • AThey can no longer be used in the Pivot tool.
    • BThey can still be used in the Pivot tool but only with the accelerate_pivot capability.
    • CThey can be used with Pivot, the |tstats command, or the |datamodel command.
    • DThey can be used with the |tstats command, but will only return that data which has been accelerated.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 151. 226 questions available.