Pass Your Splunk Core Certified Power User SPLK-1002 Exam on Oct 05, 2023 with 185 Questions
SPLK-1002 Free Exam Study Guide! (Updated 185 Questions)
NEW QUESTION # 63
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
- A. | chart count over user by vendor_action
- B. | chart count by vendor_action over user
- C. | chart count over vendor_action, user
- D. | chart count by vendor_action, user
Answer: B
NEW QUESTION # 64
A data model consists of which three types of datasets?
- A. Events, searches, transactions.
- B. Field extraction, regex, delimited.
- C. Transaction, session ID, metadata.
- D. Constraint, field, value.
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Splexicon:Datamodeldataset
NEW QUESTION # 65
The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)
- A. The dashboard is private.
- B. Fast mode is enabled.
- C. The person in the organization running the report does not have access to the index.
- D. The extraction is private-
Answer: A,C
NEW QUESTION # 66
When should transaction be used?
- A. Only in a large distributed Splunk environment.
- B. When event grouping is based on start/end values.
- C. When grouping events results in over 1000 events in each group.
- D. When calculating results from one or more fields.
Answer: C
NEW QUESTION # 67
Which of the following statements describe calculated fields? (Choose all that apply.)
- A. Calculated fields are shortcuts for performing calculations using the evalcommand.
- B. Calculated fields can only be applied to host and sourcetype.
- C. Calculated fields can be based on an extracted field.
- D. Calculated fields can be used in the search bar.
Answer: A,C,D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields
NEW QUESTION # 68
Which of the following are required to create a POST workflow action?
- A. Label, URI, post arguments.
- B. Label, URI, search string.
- C. XMI attributes, URI, name.
- D. URI, search string, time range picker.
Answer: C
NEW QUESTION # 69
Which of these search strings is NOT valid:
- A. index=web status=50* | chart count over host, status
- B. index=web status=50* | chart count over host by status
- C. index=web status=5-* | chart count by host, status
Answer: B
NEW QUESTION # 70
Which of the following statements is true, especially in large environments?
- A. The stats command is faster and more efficient than the transaction command
- B. Use the scats command when you next to group events by two or more fields.
- C. Use the transaction command when you want to see the results of a calculation.
- D. The transaction command is faster and more efficient than the stats command.
Answer: A
Explanation:
Reference:
https://answers.splunk.com/answers/103/transaction-vs-stats-commands.html
NEW QUESTION # 71
Where are the results of evalcommands stored?
- A. In a KV Store.
- B. In a database.
- C. In an index.
- D. In a field.
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Eval
NEW QUESTION # 72
Alert throttling is used to _______.
- A. stop spamming yourself with alerts
- B. stagger search request in a time sequenced order
- C. verify each alert
- D. check severity
Answer: A
NEW QUESTION # 73
The gauge command:
- A. creates a radial gauge visualization
- B. allows you to set colored ranges for a single-value visualization
- C. creates a single-value visualization
Answer: B
NEW QUESTION # 74
Which of the following workflow actions can be executed from search results? (select all that apply)
- A. LOOKUP
- B. POST
- C. Search
- D. GET
Answer: B,C,D
NEW QUESTION # 75
What does the following search do?
- A. Creates a table of the total count of mysterymeat corndogs split by user.
- B. Creates a table that groups the total number of users by vegetarian corndogs.
- C. Creates a table with the count of all types of corndogs eaten split by user.
- D. Creates a table of the total count of users and split by corndogs.
Answer: A
NEW QUESTION # 76
What is the correct way to name a macro with two arguments?
- A. us_sales2
- B. us_sales(2)
- C. us_sale,2
- D. us_sales(1,2)
Answer: B
NEW QUESTION # 77
In what order are the following knowledge objects/configurations applied?
- A. Field Extractions, Field Aliases, Lookups
- B. Field Extractions, Lookups, Field Aliases
- C. Lookups, Field Aliases, Field Extractions
- D. Field Aliases, Field Extractions, Lookups
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/WhatisSplunkknowledge
NEW QUESTION # 78
Calculated fields can be based on which of the following?
- A. Tags
- B. Extracted fields
- C. Fields generated from a search string
- D. Output fields for a lookup
Answer: B
NEW QUESTION # 79
Which of the following statements is true, especially in large environments?
- A. The stats command is faster and more efficient than the transaction command
- B. Use the scats command when you next to group events by two or more fields.
- C. Use the transaction command when you want to see the results of a calculation.
- D. The transaction command is faster and more efficient than the stats command.
Answer: A
NEW QUESTION # 80
When creating a Search workflow action, which field is required?
- A. Permission setting
- B. Search string
- C. An evalstatement
- D. Data model name
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Setupasearchworkflowaction
NEW QUESTION # 81
Which workflow action method can be used the action type is set to link?
- A. Search
- B. UPDATE
- C. PUT
- D. GET
Answer: D
Explanation:
Contoso identifies the following technical requirements:
* Data scientists must test Butler by using ASDK.
* Whenever possible, solutions must minimize costs.
* Butler must greet users by name when they first connect.
* Butler must be able to handle up to 10.000 messages a day.
* Butler must recognize the users' intent based on basic utterances.
* All configurations to the Azure Bot Service must be logged centrally.
* Whenever possible, solutions must use the principle of least privilege.
* Internal users must be able to access Butler by using Microsoft Skype for Business.
* The new Bookings app must provide a user interface where users can interact with Butler.
* Users in an Azure AD group named KeyManagers must be able to manage keys for all Azure Cognitive Services.
* Butler must provide users with the ability to reserve a room, cancel a reservation, and view existing reservations.
* The new Bookings app must be available to users in North America and Europe if a single data center or Azure region fails.
* For continuous improvement, you must be able to test Butler by sending sample utterances and comparing the chatbot's responses to the actua intent.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps
* Navigate to Settings > Fields > Workflow Actions.
* Click New to open up a new workflow action form.
* Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu. Labels can be static or include the value of relevant fields.
* Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
* For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
* Set Action type to link.
* In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
* Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
* Set the Link method to get.
* Click Save to save your workflow action definition.
NEW QUESTION # 82
Which of the following statements describes field aliases?
- A. Field aliases can be used in lookup file definitions.
- B. Field aliases only normalize data across sources and sourcetypes.
- C. Field alias names are not case sensitive when used as part of a search.
- D. Field alias names replace the original field name.
Answer: C
NEW QUESTION # 83
Which of the following knowledge objects represents the output of an evalexpression?
- A. Eval fields
- B. Field extractions
- C. Calculated fields
- D. Calculated lookups
Answer: C
Explanation:
Explanation/Reference: https://docs.splunk.com/Splexicon:Calculatedfield
NEW QUESTION # 84
Which of the following searches show a valid use of macro? (Select all that apply)
- A. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
- B. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
- C. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
- D. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
Answer: A,C
Explanation:
Reference:https://answers.splunk.com/answers/574643/field-showing-an-additional-and-not-visible-value-1.html
NEW QUESTION # 85
......
SPLK-1002 Dumps for Splunk Core Certified Power User Certified Exam Questions and Answer: https://www.prepawaypdf.com/Splunk/SPLK-1002-practice-exam-dumps.html
Realistic Verified SPLK-1002 exam dumps Q&As - SPLK-1002 Free Update: https://drive.google.com/open?id=1hQVtzf-D59ctyqF8N14gHdEYqAJRW3fb