SPLK-1002 practice questions 81–90

1. Question 81 · 226 in bank

   When is a GET workflow action needed?

   • ATo send field values to an external resource.
   • BTo retrieve information from an external resource.
   • CTo use field values to perform a secondary search.
   • DTo define how events flow from forwarders to indexes.

   Show answer

   Answer: B

   Next question

2. Question 82 · 226 in bank

   Which of the following statements describe GET workflow actions?

   • AGET workflow actions must be configured with POST arguments.
   • BConfiguration of GET workflow actions includes choosing a sourcetype.
   • CLabel names for GET workflow actions must include a field name surrounded by dollar signs.
   • DGET workflow actions can be configured to open the URI link in the current window or in a new window.

   Show answer

   Answer: D

   Next question

3. Question 83 · 226 in bank

   Which are valid ways to create an event type? (Choose all that apply.)

   • ABy using the searchtypes command in the search bar.
   • BBy editing the event_type stanza in the props.conf file.
   • CBy going to the Settings menu and clicking Event Types > New.
   • DBy selecting an event in search results and clicking Event Actions > Build Event Type.

   Show answer

   Answer: C

   Next question

4. Question 84 · 226 in bank

   Which command can include both an over and a by clause to divide results into sub-groupings?

   • Achart
   • Bstats
   • Cxyseries
   • Dtransaction

   Show answer

   Answer: A

   Next question

5. Question 85 · 226 in bank

   When should you use the transaction command instead of the stats command?

   • AWhen you need to group on multiple values.
   • BWhen duration is irrelevant in search results.
   • CWhen you have over 1000 events in a transaction.
   • DWhen you need to group based on start and end constraints.

   Show answer

   Answer: D

   Next question

6. Question 86 · 226 in bank

   Which of the following statements describes POST workflow actions?

   • APOST workflow actions are always encrypted.
   • BPOST workflow actions cannot use field values in their URI.
   • CPOST workflow actions cannot be created on custom sourcetypes.
   • DPOST workflow actions can open a web page in either the same window or a new window.

   Show answer

   Answer: D

   Next question

7. Question 87 · 226 in bank

   Select 2

   What does the Splunk Common Information Model (CIM) add-on include? (Choose all that apply.)

   • ACustom visualizations
   • BPre-configured data models
   • CFields and event category tags
   • DAutomatic data model acceleration

   Show answer

   Answer: BC

   Next question

8. Question 88 · 226 in bank

   Which of the following statements about tags is true?

   • ATags are case insensitive.
   • BTags are created at index time.
   • CTags can make your data more understandable.
   • DTags are searched by using the syntax tag::<fieldname>

   Show answer

   Answer: C

   Next question

9. Question 89 · 226 in bank

   Which of the following file formats can be extracted using a delimiter field extraction?

   • ACSV
   • BPDF
   • CXML
   • DJSON

   Show answer

   Answer: A

   Next question

10. Question 90 · 226 in bank

    A user wants to create a new field alias for a field that appears in two sourcetypes. How many field aliases need to be created?

    • AOne.
    • BTwo.
    • CIt depends on whether the original fields have the same name.
    • DIt depends on whether the two sourcetypes are associated with the same index.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 81. 226 questions available.