SPLK-1002 by Splunk Actual Free Exam Q&As

Question 1

The timechart command is an example of which of the following command types?

A. Statistical B. Orchestrating C. Transforming D. Generating

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

A calculated field may be based on which of the following?

A. Regular expressions B. Fields generated within a search string C. Extracted fields D. Lookup tables

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

Consider the the following search run over a time range of last 7 days:
index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane Which option is used to change the default time span so that results are grouped into 12 hour intervals?

A. timespan=12h B. timespan=12 C. span=12 D. span=12h

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

which of the following are valid options with the chart command

A. fillfield B. usenull C. usefiled D. useother

Discussion 0

Correct Answer: B,D Vote an answer

Question 5

Why are tags useful in Splunk?

A. Tags visualize data with graphs and charts. B. Tags group related data together. C. Tags add fields to the raw event data. D. Tags look for less specific data.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

A. It groups events that share the same clientip and host. B. The first and last events are no more than 30 seconds apart. C. Events in the transaction occurred within 5 seconds. D. The first and last events are no more than 5 seconds apart.

Discussion 0

Correct Answer: A,B,C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

A. deleted B. automatically accelerated C. all of the above D. skipped or deferred

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

What are search macros?

A. Reusable pieces of search processing language. B. A method to normalize fields. C. Lookup definitions in lookup tables. D. Categories of search results.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 9

It is mandatory for the lookup file to have this for an automatic lookup to work.

A. Timestamp B. Source type C. At least five columns D. Input filed

Discussion 0

Correct Answer: D Vote an answer

Question 10

Which of the following commands support the same set of functions?

A. stats, chart, timechart B. transaction, chart, timechart C. search, where, eval D. stats, eval, table

Discussion 0

Correct Answer: A Vote an answer

Question 11

Which of the following statements would help a user choose between the transaction and stats commands?

A. state can only group events using IP addresses. B. Use state when the events need to be viewed as a single event. C. The transaction command is faster and more efficient. D. There is a 1000 event limitation with the transaction command.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 12

Which of the following search modes automatically returns all extracted fields in the fields sidebar?

A. Smart B. Fast C. C. Verbose

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 13

These kinds of charts represent a series in a single bar with multiple sections

A. Stacked B. Omit nulls C. Multi-Series D. Split-Series

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 14

Consider the following search:
index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group.
From the following list, which search groups events by JSESSIONID?

A. index=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID B. index=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117 C. index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117 D. index=web sourcetype=access_combined JSESSIONID < SD470K92802F117 >

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Splunk Core Certified Power User - SPLK-1002 Exam Practice Test