SPLK-1002 by Splunk Actual Free Exam Q&As

Question 1

Which of the following actions can the eval command perform?

A. Save SPL commands to be reused in other searches. B. Create or replace an existing field. C. Group transactions by one or more fields. D. Remove fields from results.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

A. Commas B. Spaces C. Tabs D. Pipes

Discussion 0

Correct Answer: A,B,D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

A. The macro name is sessiontracker and the arguments are action, JESSIONID. B. The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$. C. The macro name is sessiontracker and the arguments are $action$, $JESSIONID$. D. The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Which group of users would most likely use pivots?

A. Knowledge Managers B. Users C. Administrators D. Architects

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

What syntax would a user specify to search for the prod tag associated with the host field and webserver value?

A. prod:host=webserver B. tag::host=prod C. prod=host:webserver D. prod=host::webserver

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

A user wants a table that will show the total revenue made for each product in each sales region. Which would be the correct SPL query to use?

A. index=X sourcetype=Y | chart sum(product) by price AND region B. index=X | chart sum(price) by product, region C. index=X | chart total(product) over price by region D. index=X | chart total(price) by product, region

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

If a calculated field has the same name as an extracted field, what happens to the extracted field?

A. The calculated field will duplicate the extracted field. B. An error will be returned and the search will fail. C. The calculated field will override the extracted field. D. The calculated and extracted fields will be combined.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

Which of the following definitions describes a macro named "samplemacro" that accepts two arguments?

A. samplemacro(1,2) B. samplemacro[2] C. Examplemacro [1,2] D. u amp -CJEUCXG (2)

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 9

These allow you to categorize events based on search terms.
Select your answer.

A. Macros B. Groups C. Event Types D. Tags

Discussion 0

Correct Answer: C Vote an answer

Question 10

Which of the following commands connects an additional table of data directly to the right side of the existing table?

A. update B. appendcols C. append D. subsearch

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Splunk Core Certified Power User - SPLK-1002 Exam Practice Test