SPLK-1002 practice questions 211–220

1. Question 211 · 226 in bank

   Given the event below, how can the value in the Zip_Code field be used to retrieve the local weather from an external resource? 25/Oct/2023:20:29:43 , 150.100.182.143 , v2.003 , Zip_Code: 72630 , DataCenter: DC1

   • ACreate a Search workflow action.
   • BCreate a POST workflow action.
   • CCreate a GET workflow action.
   • DCreate a PUT workflow action.

   Show answer

   Answer: C

   Next question

2. Question 212 · 226 in bank

   Which of the following is true about event types?

   • ASubsearches can be used in an event type definition.
   • BSeveral event types can be associated with an event.
   • CCreation of event types can only occur through Splunk Web.
   • DSaved searches can be used in an event type definition.

   Show answer

   Answer: B

   Next question

3. Question 213 · 226 in bank

   Consider the following search: index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD515K110O2F460). View the events as a group. From the following list, which search groups events by JSESSIONID?

   • Aindex=web sourcetype=access combined JSESSIONID
   • Bindex=web sourcetype=access combined SD515K110O2F460 | table JSESSIONID
   • Cindex=web sourcetype=access_combined | transaction JSESSIONID | search SD515K110O2F460
   • Dindex=web sourcetype=access_combined | highlight JSESSIONID | search SD515K110O2F460

   Show answer

   Answer: C

   Next question

4. Question 214 · 226 in bank

   What type of expression is used to validate a search macro argument?

   • Atstats
   • Bstats
   • Crest
   • Deval

   Show answer

   Answer: D

   Next question

5. Question 215 · 226 in bank

   Which of the following does not describe how to create an event type?

   • ASelect search criteria within the Event Type Builder.
   • BUse the New Event Type button from the Settings menu.
   • CRun a search string and use the Save As button.
   • DUse the Field Extractor to analyze and use the Save As button.

   Show answer

   Answer: D

   Next question

6. Question 216 · 226 in bank

   Which of these SPL queries will correctly return results with an IP address of 192.0.0.1?

   • Aindex=proxy | where like(ipaddress, "192")
   • Bindex proxy | where like(ipaddress, "192.")
   • Cindex=proxy | where like(ipaddress, "192.%")
   • Dindex=proxy | where like(ipaddress, "192.*")

   Show answer

   Answer: C

   Next question

7. Question 217 · 226 in bank

   A user wants to retrieve IP address information. How should the URI be specified to configure a GET workflow action?

   • Ahttp://whois.net/whois/%domain%
   • Bhttp://whois.net/whois/'domain'
   • Chttp://whois.net/whois/*domain*
   • Dhttp://whois.net/whois/$domain$

   Show answer

   Answer: D

   Next question

8. Question 218 · 226 in bank

   What type of dataset cannot be accelerated?

   • ASearch
   • BRoot
   • CTransaction
   • DEvent

   Show answer

   Answer: C

   Next question

9. Question 219 · 226 in bank

   Which of the following can be saved as an event type?

   • Aindex=server_503 sourcetype=BETA_923 code=988 | stats count by code
   • Bindex=server_503 sourcetype=BETA_923 code=988 | stats where code > 200
   • Cindex=server_503 sourcetype=BETA_923 code=988
   • Dindex=server_503 sourcetype=BETA_923 code=988 [|inputlookup append=t servercode.csv]

   Show answer

   Answer: C

   Next question

10. Question 220 · 226 in bank

    How are attributes inherited in a data model?

    • AParent datasets only inherit default fields from the first child dataset.
    • BChild datasets only inherit default fields from the parent events.
    • CChild datasets inherit all fields from the parent events.
    • DParent datasets inherit all fields from the first child dataset.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 211. 226 questions available.