SPLK-1002 practice questions 11–20

1. Question 11 · 226 in bank

   By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

   • ATurned off.
   • BTurned on.
   • CDetermined automatically based on the sourcetype.
   • DDetermined automatically based on the data source.

   Show answer

   Answer: A

   Next question

2. Question 12 · 226 in bank

   Select 3

   Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)

   • ACIM is a methodology for normalizing data.
   • BCIM can correlate data from different sources.
   • CThe Knowledge Manager uses the CIM to create knowledge objects.
   • DCIM is an app that can coexist with other apps on a single Splunk deployment.

   Show answer

   Answer: ABC

   Next question

3. Question 13 · 226 in bank

   Which of the following knowledge objects represents the output of an eval expression?

   • AEval fields
   • BCalculated fields
   • CField extractions
   • DCalculated lookups

   Show answer

   Answer: B

   Next question

4. Question 14 · 226 in bank

   What do events in a transaction have in common?

   • AAll events in a transaction must have the same timestamp.
   • BAll events in a transaction must have the same sourcetype.
   • CAll events in a transaction must have the exact same set of fields.
   • DAll events in a transaction must be related by one or more fields.

   Show answer

   Answer: D

   Next question

5. Question 15 · 226 in bank

   Select 3

   Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)

   • ATabs
   • BPipes
   • CSpaces
   • DCommas

   Show answer

   Answer: ABC

   Next question

6. Question 16 · 226 in bank

   A data model consists of which three types of datasets?

   • AConstraint, field, value.
   • BEvents, searches, transactions.
   • CField extraction, regex, delimited.
   • DTransaction, session ID, metadata.

   Show answer

   Answer: B

   Next question

7. Question 17 · 226 in bank

   Where are the results of eval commands stored?

   • AIn a field.
   • BIn an index.
   • CIn a KV Store.
   • DIn a database.

   Show answer

   Answer: A

   Next question

8. Question 18 · 226 in bank

   Select 3

   Which of the following statements describe calculated fields? (Choose all that apply.)

   • ACalculated fields can be used in the search bar.
   • BCalculated fields can be based on an extracted field.
   • CCalculated fields can only be applied to host and sourcetype.
   • DCalculated fields are shortcuts for performing calculations using the eval command.

   Show answer

   Answer: ABD

   Next question

9. Question 19 · 226 in bank

   Calculated fields can be based on which of the following?

   • ATags
   • BExtracted fields
   • COutput fields for a lookup
   • DFields generated from a search string

   Show answer

   Answer: B

   Next question

10. Question 20 · 226 in bank

    When should transaction be used?

    • AOnly in a large distributed Splunk environment.
    • BWhen calculating results from one or more fields.
    • CWhen event grouping is based on start/end values.
    • DWhen grouping events results in over 1000 events in each group.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 11. 226 questions available.