Splunk Splunk Certifications SPLK-1002 Questions & Answers

• Question 1:

  Which of the following workflow actions can be executed from search results? (select all that apply)

  A. GET

  B. POST

  C. LOOKUP

  D. Search

  Correct Answer: ABD

  Explanation: As mentioned before, there are two types of workflow actions: GET and POST1. Both types of workflow actions can be executed from search results by clicking on an event field value that has a workflow action configured for it1. Another type of workflow action is Search, which runs another search based on the field value1. Therefore, options A, B and D are correct, while option C is incorrect because LOOKUP is not a type of workflow action.

• Question 2:

  Which of the following statements describes macros?

  A. A macro is a reusable search string that must contain the full search.

  B. A macro is a reusable search string that must have a fixed time range.

  C. A macro Is a reusable search string that may have a flexible time range.

  D. A macro Is a reusable search string that must contain only a portion of the search.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros

  A macro is a reusable search string that can contain any part of a search, such as search terms, commands, arguments, etc. A macro can have a flexible time range that can be specified when the macro is executed. A macro can also have arguments that can be passed to the macro when it is executed. A macro can be created by using the Settings menu or by editing the macros.conf file. A macro does not have to contain the full search, but only the part that needs to be reused. A macro does not have to have a fixed time range, but can use a relative or absolute time range modifier. A macro does not have to contain only a portion of the search, but can contain multiple parts of the search.

• Question 3:

  A calculated field maybe based on which of the following?

  A. Lookup tables

  B. Extracted fields

  C. Regular expressions

  D. Fields generated within a search string

  Correct Answer: B

  Explanation: As mentioned before, a calculated field is a field that you create based on the value of another field or fields2. A calculated field can be based on extracted fields, which are fields that are extracted from your raw data using various methods such as regular expressions, delimiters or key-value pairs2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of fields that a calculated field can be based on.

• Question 4:

  In which of the following scenarios is an event type more effective than a saved search?

  A. When a search should always include the same time range.

  B. When a search needs to be added to other users' dashboards.

  C. When the search string needs to be used in future searches.

  D. When formatting needs to be included with the search string.

  Correct Answer: C

  Reference: https://answers.splunk.com/answers/4993/eventtype-vs-saved-search.html

  An event type is a way to categorize events based on a search string that matches the events2. You can use event types to simplify your searches by replacing long or complex search strings with short and simple event type names2. An event type is more effective than a saved search when the search string needs to be used in future searches because it allows you to reuse the search string without having to remember or type it again2. Therefore, option C is correct, while options A, B and D are incorrect because they are not scenarios where an event type is more effective than a saved search.

• Question 5:

  Which of the following statements describes Search workflow actions?

  A. By default. Search workflow actions will run as a real-time search.

  B. Search workflow actions can be configured as scheduled searches,

  C. The user can define the time range of the search when created the workflow action.

  D. Search workflow actions cannot be configured with a search string that includes the transaction command

  Correct Answer: C

  Explanation: Search workflow actions are custom actions that run a search when you click on a field value in your search results. Search workflow actions can be configured with various options, such as label name, search string, time range, app context, etc. One of the options is to define the time range of the search when creating the workflow action. You can choose from predefined time ranges, such as Last 24 hours, Last 7 days, etc., or specify a custom time range using relative or absolute time modifiers. Search workflow actions do not run as real-time searches by default, but rather use the same time range as the original search unless specified otherwise. Search workflow actions cannot be configured as scheduled searches, as they are only triggered by user interaction. Search workflow actions can be configured with any valid search string that includes any search command, such as transaction.

• Question 6:

  Which of the following statements describe the search below? (select all that apply)

  Index=main I transaction clientip host maxspan=30s maxpause=5s

  A. Events in the transaction occurred within 5 seconds.

  B. It groups events that share the same clientip and host.

  C. The first and last events are no more than 5 seconds apart.

  D. The first and last events are no more than 30 seconds apart.

  Correct Answer: ABD

  Explanation: The search below groups events by two or more fields (clientip and host), creates transactions with start and end constraints (maxspan=30s and maxpause=5s), and calculates the duration of each transaction.

  index=main | transaction clientip host maxspan=30s maxpause=5s The search does the following:

  It filters the events by the index main, which is a default index in Splunk that contains all data that is not sent to other indexes. It uses the transaction command to group events into transactions based on two fields: clientip and host. The

  transaction command creates new events from groups of events that share the same clientip and host values. It specifies the start and end constraints for the transactions using the maxspan and maxpause arguments. The maxspan

  argument sets the maximum time span between the first and last events in a transaction. The maxpause argument sets the maximum time span between any two consecutive events in a transaction. In this case, the maxspan is 30 seconds

  and the maxpause is 5 seconds, meaning that any transaction that has a longer time span or pause will be split into multiple transactions.

  It creates some additional fields for each transaction, such as duration, eventcount, startime, etc. The duration field shows the time span between the first and last events in a transaction.

• Question 7:

  Which of the following knowledge objects represents the output of an eval expression?

  A. Eval fields

  B. Calculated fields

  C. Field extractions

  D. Calculated lookups

  Correct Answer: B

  Reference: https://docs.splunk.com/Splexicon:Calculatedfield The eval command is used to create new fields or modify existing fields based on an expression2. The output of an eval expression is a calculated field, which is a field that you create based on the value of another field or fields2. You can use calculated fields to enrich your data with additional information or to transform your data into a more useful format2. Therefore, option B is correct, while options A, C and D are incorrect because they are not names of knowledge objects that represent the output of an eval expression.

• Question 8:

  A user wants to convert numeric field values to strings and also to sort on those values.

  Which command should be used first, the eval or the sort?

  A. It doesn't matter whether eval or sort is used first.

  B. Convert the numeric to a string with eval first, then sort.

  C. Use sort first, then convert the numeric to a string with eval.

  D. You cannot use the sort command and the eval command on the same field.

  Correct Answer: C

  Explanation: The eval command is used to create new fields or modify existing fields based on an expression2. The sort command is used to sort the results by one or more fields in ascending or descending order2. If you want to convert numeric field values to strings and also sort on those values, you should use the sort command first, then use the eval command to convert the values to strings2. This way, the sort command will use the original numeric values for sorting, rather than the converted string values which may not sort correctly. Therefore, option C is correct, while options A, B and D are incorrect.

• Question 9:

  Which of the following describes the Splunk Common Information Model (CIM) add-on?

  A. The CIM add-on uses machine learning to normalize data.

  B. The CIM add-on contains dashboards that show how to map data.

  C. The CIM add-on contains data models to help you normalize data.

  D. The CIM add-on is automatically installed in a Splunk environment.

  Correct Answer: C

  Explanation: The Splunk Common Information Model (CIM) add-on is a Splunk app that contains data models to help you normalize data from different sources and formats. The CIM add-on defines a common and consistent way of naming and categorizing fields and events in Splunk. This makes it easier to correlate and analyze data across different domains, such as network, security, web, etc. The CIM add-on does not use machine learning to normalize data, but rather relies on predefined field names and values. The CIM add-on does not contain dashboards that show how to map data, but rather provides documentation and examples on how to use the data models. The CIM add-on is not automatically installed in a Splunk environment, but rather needs to be downloaded and installed from Splunkbase.

• Question 10:

  Which of the following statements describe calculated fields? (select all that apply)

  A. Calculated fields can be used in the search bar.

  B. Calculated fields can be based on an extracted field.

  C. Calculated fields can only be applied to host and sourcetype.

  D. Calculated fields are shortcuts for performing calculations using the eval command.

  Correct Answer: ABD

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields

  Calculated fields are fields that are created by performing calculations on existing fields using the eval command. Calculated fields can be used in the search bar to filter and transform events based on the calculated values. Calculated fields can also be based on an extracted field, which is a field that is extracted from raw data using various methods, such as regex, delimiters, lookups, etc. Calculated fields are not shortcuts for performing calculations using the eval command, but rather results of performing calculations using the eval command. Calculated fields can be applied to any field in Splunk, not only host and sourcetype.

  Therefore, statements A, B, and D are true about calculated fields.