Verified SPLK-1002 Dumps Q&As - SPLK-1002 Test Engine with Correct Answers
Pass Your SPLK-1002 Dumps as PDF Updated on 2021 With 179 Questions
NEW QUESTION 30
The iplocation and geostats command can be used together.
- A. True
- B. False
Answer: A
NEW QUESTION 31
In what order arc the following knowledge objects/configurations applied?
- A. Field Aliases, Field Extractions, Lookups
- B. Lookups, Field Aliases, Field Extractions
- C. Field Extractions, Lookups, Field Aliases
- D. Field Extractions, Field Aliases, Lookups
Answer: C
NEW QUESTION 32
The Splunk search language supports the + wildcard.
- A. True
- B. False
Answer: B
NEW QUESTION 33
Which of the following can be used with the eval command tostring function (select all that apply)
- A. ''duration''
- B. ''Decimal''
- C. ''commas''
- D. ''hex''
Answer: A,C,D
NEW QUESTION 34
Which search would limit an "alert" tag to the "host" field?
- A. tag=alert
- B. host::tag::alert
- C. tag==alert
- D. tag::host=alert
Answer: D
NEW QUESTION 35
Which of the following is NOT a stats function:
- A. sum
- B. avg
- C. addtotals
- D. count
Answer: C
NEW QUESTION 36
Which of the following statements describes POST workflow actions?
- A. By default, POST workflow actions are shown in both the event and field menus.
- B. POST workflow actions can be configured to send POST arguments to the URI location.
- C. POST workflow actions can be configured to send email to the URI location.
- D. Configuration of a POST workflow action includes choosing a sourcetype.
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/SetupaPOSTworkflowaction
NEW QUESTION 37
Which of the following actions can the aval command perform?
- A. Save SPL commands to be reused in other searches.
- B. Remove fields from results.
- C. Create or replace an existing field.
- D. Group transactions by one or more fields.
Answer: C
NEW QUESTION 38
Splunk Components:
Which of the following are responsible for reducing search results?
- A. search heads
- B. indexers
- C. forwarders
Answer: B
NEW QUESTION 39
Which type of visualization shows relationships between discrete values in three dimensions?
- A. Pie chart
- B. Line chart
- C. Bubble chart
- D. Scatter chart
Answer: C
Explanation:
Explanation
https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/chartsBub
NEW QUESTION 40
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
- A. Pre-configured data models
- B. Custom visualizations
- C. Fields and event category tags
- D. Automatic data model acceleration
Answer: B,C
NEW QUESTION 41
Which of the following can be used with the eval command tostring function (select all that apply)
- A. ''duration''
- B. ''Decimal''
- C. ''commas''
- D. ''hex''
Answer: A,C,D
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/ConversionFunctions#tostring.28X.2CY.29
NEW QUESTION 42
To identify all of the contributing events within a transaction that contain at least one REJECTevent, which syntax is correct?
- A. index=main REJECT | transaction sessionid
- B. index=main | transaction sessionid | where transaction=reject
- C. index=main | transaction sessionid | search REJECT
- D. index=main | transaction sessionid | where transaction="REJECT*"
Answer: C
NEW QUESTION 43
Which of the following statements describes the use of the Field Extractor (FX)?
- A. The Field Extractor uses PERL to extract fields from the raw events.
- B. Fields extracted using the Field Extractor do not persist and must be defined for each search.
- C. The Field Extractor automatically extracts all fields at search time.
- D. Fields extracted using the Field Extractor persist as knowledge objects.
Answer: D
Explanation:
Explanation
NEW QUESTION 44
When using timechart, how many fields can be listed after a by clause? ( Choose Two )
- A. because _time is already implied as the x-axis.
- B. because timechart doesn't support using a by clause.
- C. There is no limit specific to timechart.
- D. because one field would represent the x-axis and the other would represent the y-axis.
Answer: A,C
NEW QUESTION 45
In which Settings section are macros defined?
- A. Searches, Reports, Alerts
- B. Advanced Search
- C. Tokens
- D. Fields
Answer: B
NEW QUESTION 46
Data model are composed of one or more of which of the fo-owing datasets? (select all that apply.)
- A. Search datasets
- B. Events datasets
- C. Any child of event, transaction, and search datasets
- D. Transaction datasets
Answer: A,B,D
NEW QUESTION 47
Which of the following search modes automatically returns all extracted fields in the fields sidebar?
- A. Smart
- B. Fast
- C. Verbose
Answer: C
NEW QUESTION 48
The eval command allows you to do which of the following? (Choose all that apply.)
- A. Convert values
- B. Perform calculations
- C. Format values
- D. Use conditional statements
Answer: A,B,C,D
NEW QUESTION 49
What does the following search do?
index=condlog type=mysterymeat action=eaten I scats count as cornlog_count by us:
- A. Creates a table of the total count of users and split by corndogs.
- B. Creates a table that groups the total number of users by vegetarian corndogs.
- C. Creates a table of the total count of mysterymeat corndogs split by user.
- D. Creates a table with the count of all types of corndogs eaten split by user.
Answer: C
NEW QUESTION 50
__________ datasets can be added to root dataset to narrow down the search
- A. event
- B. extracted
- C. parent
- D. child
Answer: D
NEW QUESTION 51
Alerts trigger when search results meet specific conditions.
- A. True
- B. False
Answer: A
NEW QUESTION 52
Fast, optimized and verbose are all selectable search modes.
- A. True
- B. False
Answer: B
NEW QUESTION 53
Which of the following statements describes POST workflow actions?
- A. POST workflow actions can open a web page in either the same window or a new .
- B. POST workflow actions cannot use field values in their URI.
- C. POST workflow actions cannot be created on custom sourcetypes.
- D. POST workflow actions are always encrypted.
Answer: A
NEW QUESTION 54
......
Pass Splunk SPLK-1002 Exam Info and Free Practice Test: https://www.examdumpsvce.com/SPLK-1002-valid-exam-dumps.html
Splunk SPLK-1002 Real Exam Questions and Answers FREE: https://drive.google.com/open?id=16FMZo5O6NNyBBhTEXeLp3j4WnqcC9iLi
