SPLK-1002 practice questions 61–70

1. Question 61 · 226 in bank

   Which of the following statements describes the use of the Field Extractor (FX)?

   • AThe Field Extractor automatically extracts all fields at search time.
   • BThe Field Extractor uses PERL to extract fields from the raw events.
   • CFields extracted using the Field Extractor persist as knowledge objects.
   • DFields extracted using the Field Extractor do not persist and must be defined for each search.

   Show answer

   Answer: C

   Next question

2. Question 62 · 226 in bank

   Which of the following searches would return a report of sales by product_name?

   • Achart sales by product_name
   • Bchart sum(price) as sales by product_name
   • Cstats sum(price) as sales over product_name
   • Dtimechart list(sales), values(product_name)

   Show answer

   Answer: B

   Next question

3. Question 63 · 226 in bank

   Select 3

   Which of the following data models are included in the Splunk Common Information Model (CIM) add-on? (Choose all that apply.)

   • AAlerts
   • BEmail
   • CDatabases
   • DUser permissions

   Show answer

   Answer: ABC

   Next question

4. Question 64 · 226 in bank

   What is a limitation of searches generated by workflow actions?

   • ASearches generated by workflow actions cannot use macros.
   • BSearches generated by workflow actions must be less than 256 characters long.
   • CSearches generated by workflow actions must run in the same app as the workflow action.
   • DSearches generated by workflow actions run with the same permissions as the user running them.

   Show answer

   Answer: D

   Next question

5. Question 65 · 226 in bank

   Which of the following searches would create a graph similar to the one below?

   

   • Aindex=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | stats count by status
   • Bindex=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | chart count OVER status by _time
   • Cindex=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status
   • DNone of these searches would generate a similar graph.

   Show answer

   Answer: D

   Next question

6. Question 66 · 226 in bank

   What does the transaction command do?

   • AGroups a set of transactions based on time.
   • BCreates a single event from a group of events.
   • CSeparates two events based on one or more values.
   • DReturns the number of credit card transactions found in the event logs.

   Show answer

   Answer: B

   Next question

7. Question 67 · 226 in bank

   What is the relationship between data models and pivots?

   • AData models provide the datasets for pivots.
   • BPivots and data models have no relationship.
   • CPivots and data models are the same thing.
   • DPivots provide the datasets for data models.

   Show answer

   Answer: A

   Next question

8. Question 68 · 226 in bank

   Which of the following statements describes Search workflow actions?

   • ABy default, Search workflow actions will run as a real-time search.
   • BSearch workflow actions can be configured as scheduled searches.
   • CThe user can define the time range of the search when created the workflow action.
   • DSearch workflow actions cannot be configured with a search string that includes the transaction command.

   Show answer

   Answer: C

   Next question

9. Question 69 · 226 in bank

   Which of the following commands support the same set of functions?

   • Astats, eval, table
   • Bsearch, where, eval
   • Cstats, chart, timechart
   • Dtransaction, chart, timechart

   Show answer

   Answer: C

   Next question

10. Question 70 · 226 in bank

    Select 4

    The eval command allows you to do which of the following? (Choose all that apply.)

    • AFormat values
    • BConvert values
    • CPerform calculations
    • DUse conditional statements

    Show answer

    Answer: ABCD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 61. 226 questions available.