SPLK-1002 Exam Training Practice Tests (Splunk Core Certified Power User)]

Question 1

In which of the following scenarios is an event type more effective than a saved search?

A. When a search needs to be added to other users' dashboards. B. When formatting needs to be included with the search string. C. When the search string needs to be used in future searches. D. When a search should always include the same time range.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

Which of the following does not describe how to create an event type?

A. Use the New Event Type button from the Settings menu. B. Use the Field Extractor to analyze and use the Save As button. C. Run a search string and use the Save As button. D. Select search criteria within the Event Type Builder.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

What is needed to define a calculated field?

A. Data model B. Eval expression C. Regular expression D. Event type

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

When defining a macro, what are the required elements?

A. Name and a validation error message. B. Name and arguments. C. Name and definition. D. Definition and arguments.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

A. Auto-Extracted fields can have their data type changed. B. Auto-Extracted fields can be added if they already exist in the dataset with constraints. C. Auto-Extracted fields can be given a friendly name for use in Pivot. D. Auto-Extracted fields can be hidden in Pivot.

Correct Answer: B,C,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

Why are tags useful in Splunk?

A. Tags look for less specific data. B. Tags visualize data with graphs and charts. C. Tags group related data together. D. Tags add fields to the raw event data.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Which of the following searches will return all clientip addresses that start with 108?

A. ... | where (clientip=108. % ) B. ... | where (clientip, "108. %") C. ... | where like (clientip, "108.% ) D. ... | search clientip=108

Correct Answer: C

Question 8

The macro weekly_sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?

A. 'weekly sales (3)' B. 'weekly_sales (3.99, 10)' C. 'weekly sales (3.99, 10)' D. 'weekly_sales($3.995, $108)'

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

Which of the following search modes automatically returns all extracted fields in the fields sidebar?

A. Smart B. C. Verbose C. Fast

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

which of the following are valid options with the chart command

A. usenull B. fillfield C. usefiled D. useother

Correct Answer: A,D

Question 11

Which field will be used to populate the field if the productName and product:d fields have values for a given event?
| eval productINFO=coalesco(productName,productid)

A. The value for the productName field because it appears first. B. Neither field value will be used and the field will be assigned a NULL value for the given event. C. Both field values will be used and the product INFO field will become a multivalue field for the given event. D. The value for the field because it appears second.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 12

Which of the following transforming commands can be used with transactions?

A. chart, timecha:t, stats, pivot B. chart, timeehart, datamodel, pivot C. chart, timechart, stats, eventstats D. chart, timechart, stats, diff

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 13

Which of the following statements describes macros?

A. A macro Is a reusable search string that must contain only a portion of the search. B. A macro is a reusable search string that must have a fixed time range. C. A macro Is a reusable search string that may have a flexible time range. D. A macro is a reusable search string that must contain the full search.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 14

Data models are composed of one or more of which of the following datasets? (select all that apply)

A. Events datasets B. Search datasets C. Any child of event, transaction, and search datasets D. Transaction datasets

Correct Answer: A,B,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Splunk Core Certified Power User - SPLK-1002 Exam Practice Test