A fully updated 2021 SPLK-1002 Exam Dumps exam guide from training expert BraindumpsPrep
Provides complete coverage of every objective on exam and exam preparation SPLK-1002
NEW QUESTION 95
Selected fields are displayed ______each event in the search results.
- A. above
- B. interesting fields
- C. other fields
- D. below
Answer: D
NEW QUESTION 96
Which of these is NOT a field that is automatically created with the transaction command?
- A. maxcount
- B. duration
- C. eventcount
Answer: A
NEW QUESTION 97
What is the correct syntax to search for a tag associated with a value on a specific fields?
- A. Tag-<field?
- B. Tag<filed(tagname.)
- C. Tag=<filed>::<tagname>
- D. Tag::<filed>=<tagname>
Answer: D
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/TagandaliasfieldvaluesinSplunkWeb
NEW QUESTION 98
Which of the following statements describe calculated fields? (select all that apply)
- A. Calculated fields can be used in the search bar.
- B. Calculated fields are shortcuts for performing calculations using the eval command.
- C. Calculated fields can be based on an extracted field.
- D. Calculated fields can only be applied to host and sourcetype.
Answer: B,C
NEW QUESTION 99
Which group of users would most likely use pivots?
- A. Architects
- B. Knowledge Managers
- C. Administrators
- D. Users
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Pivot/IntroductiontoPivot
NEW QUESTION 100
In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")
- A. This statement would produce an error in Splunk because it is incomplete.
- B. The description field would contain the value "Internal Server Error".
- C. The description field would contain the value 0.
- D. The description field would contain no value.
Answer: D
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/ConditionalFunctions
NEW QUESTION 101
Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)
- A. This is a valid search and will display a stats table showing the maximum pause among transactions.
- B. No results will be returned because the transaction command must include the startswith and endswith options.
- C. No results will be returned because the transaction command must be the last command used in the search pipeline.
- D. This is a valid search and will display a timechart of the average duration, of each transaction event.
Answer: D
NEW QUESTION 102
Search terms are not case sensitive.
- A. True
- B. False
Answer: A
NEW QUESTION 103
Which type of visualization shows relationships between discrete values in three dimensions?
- A. Pie chart
- B. Line chart
- C. Scatter chart
- D. Bubble chart
Answer: D
Explanation:
https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/chartsBub
NEW QUESTION 104
When creating a Search workflow action, which field is required?
- A. An eval statement
- B. Data model name
- C. Permission setting
- D. Search string
Answer: D
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Setupasearchworkflowaction
NEW QUESTION 105
Which workflow uses field values to perform a secondary search?
- A. Action
- B. Search
- C. Sub-Search
- D. POST
Answer: B
Explanation:
Explanation
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/CreateworkflowactionsinSplunkWeb
NEW QUESTION 106
Creating Data Models:
Fields associated with a data set are known as ______.
- A. Attributes
- B. Constraints
Answer: A
NEW QUESTION 107
Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status
- A. is looking for all events that include the search terms: fields AND action AND productld AND status
- B. returns a table with 3 columns
- C. users the table command to improve performance
- D. limits the fields are extracted
Answer: D
NEW QUESTION 108
Which of the following searches would create a graph similar to the one below?
index=_internal sourcetype=SavedSplunker | fields sourcetype, status |
- A. transaction status maxspan=1d | timechart count by status
- B. transaction status maxspan=1d | stats count by status
index=_internal sourcetype=SavedSplunker | fields sourcetype, status | - C. None of these searches would generate a similar graph.
- D. transaction status maxspan=1d | chart count OVER status by _time
index=_internal sourcetype=SavedSplunker | fields sourcetype, status |
Answer: C
Explanation:
None of these functions related to the graph in exhibit. All of these functions have maxspan=ld which is not a valid argument.
NEW QUESTION 109
When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?
- A. Priority
- B. Precedence
- C. Weight
- D. Rank
Answer: A
Explanation:
Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Knowledge/Defineeventtypes
NEW QUESTION 110
The iplocation and geostats command can be used together.
- A. True
- B. False
Answer: A
NEW QUESTION 111
Pivot visualizations____________.
- A. include bubble chart marker gauge and bar chart
- B. include map scatter chart and pie chart
Answer: A
NEW QUESTION 112
Which of the following statements describe GET workflow actions?
- A. Label names for GET workflow actions must include a field name surrounded by dollar signs.
- B. Configuration of GET workflow actions includes choosing a sourcetype.
- C. GET workflow actions must be configured with POST arguments.
- D. GET workflow actions can be configured to open the URT link in the current window or in a new window
Answer: D
NEW QUESTION 113
The Splunk search language supports the + wildcard.
- A. False
- B. True
Answer: A
NEW QUESTION 114
When should transaction be used?
- A. Only in a large distributed Splunk environment.
- B. When calculating results from one or more fields.
- C. When grouping events results in over 1000 events in each group.
- D. When event grouping is based on start/end values.
Answer: B
Explanation:
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Abouttransactions
NEW QUESTION 115
Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?
- A. The macro name is sessiontracker(2) and the arguments are action, JESSIONID.
- B. The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.
- C. The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.
- D. The macro name is sessiontracker and the arguments are action, JESSIONID.
Answer: A
NEW QUESTION 116
Which of the following are valid options to speed up reports? (Select all the apply.)
- A. Edit acceleration
- B. Edit schedule
- C. Edit description
- D. Edit permissions
Answer: A
NEW QUESTION 117
Which of the following knowledge objects represents the output of an eval expression?
- A. Calculated lookups
- B. Calculated fields
- C. Field extractions
- D. Eval fields
Answer: B
NEW QUESTION 118
Which of the following searches show a valid use of macro? (Select all that apply)
- A. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
- B. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
- C. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
- D. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
Answer: B,C
Explanation:
Reference:
https://answers.splunk.com/answers/574643/field-showing-an-additional-and-not-visible-value-1.html
NEW QUESTION 119
Which of the following is a function of the Splunk Common Information Model (CIM)?
- A. Reingesting previously indexed data with new field names.
- B. Normalizing data across a Splunk deployment.
- C. Algorithmically shifting events to other indexes.
- D. Providing templates for reports and dashboards.
Answer: B
NEW QUESTION 120
......
Tested Material Used To SPLK-1002: https://www.briandumpsprep.com/SPLK-1002-prep-exam-braindumps.html
Steps Necessary To Pass The SPLK-1002 Exam: https://drive.google.com/open?id=1oZBvpdCm9iILGPOzdOgSh_dY6qfOQ3JW
