Splunk Splunk Certifications SPLK-1002 Questions & Answers

• Question 161:

  Which of the following statements describe the search string below?

  | datamodel Application_State All_Application_State search

  A. Evenrches would return a report of sales by state.

  B. Events will be returned from the data model named Application_State.

  C. Events will be returned from the data model named All_Application_state.

  D. No events will be returned because the pipe should occur after the datamodel command

  Correct Answer: B

  The search string below returns events from the data model named Application_State.

  | datamodel Application_State All_Application_State search The search string does the following:

  It uses the datamodel command to access a data model in Splunk. The datamodel command takes two arguments: the name of the data model and the name of the dataset within the data model. It specifies the name of the data model as

  Application_State. This is a predefined data model in Splunk that contains information about web applications. It specifies the name of the dataset as All_Application_State. This is a root dataset in the data model that contains all events from

  all child datasets. It uses the search command to filter and transform the events from the dataset. The search command can use any search criteria or command to modify the results.

  Therefore, the search string returns events from the data model named Application_State.

• Question 162:

  Which of the following knowledge objects represents the output of an eval expression?

  A. Eval fields

  B. Calculated fields

  C. Field extractions

  D. Calculated lookups

  Correct Answer: B

  Reference: https://docs.splunk.com/Splexicon:Calculatedfield

  The eval command is used to create new fields or modify existing fields based on an expression2. The output of an eval expression is a calculated field, which is a field that you create based on the value of another field or fields2. You can use calculated fields to enrich your data with additional information or to transform your data into a more useful format2. Therefore, option B is correct, while options A, C and D are incorrect because they are not names of knowledge objects that represent the output of an eval expression.

• Question 163:

  Which of the following eval command function is valid?

  A. Int ()

  B. Count ( )

  C. Print ()

  D. Tostring ()

  Correct Answer: D

  The eval command supports a number of functions that you can use in your expressions to perform calculations, conversions, string manipulations and more2. One of the eval command functions is tostring(), which converts a numeric value to a string value2. Therefore, option D is correct, while options A, B and C are incorrect because they are not valid eval command functions.

• Question 164:

  Which of the following statements describes macros?

  A. A macro is a reusable search string that must contain the full search.

  B. A macro is a reusable search string that must have a fixed time range.

  C. A macro Is a reusable search string that may have a flexible time range.

  D. A macro Is a reusable search string that must contain only a portion of the search.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros

  A macro is a reusable search string that can contain any part of a search, such as search terms, commands, arguments, etc. A macro can have a flexible time range that can be specified when the macro is executed. A macro can also have arguments that can be passed to the macro when it is executed. A macro can be created by using the Settings menu or by editing the macros.conf file. A macro does not have to contain the full search, but only the part that needs to be reused. A macro does not have to have a fixed time range, but can use a relative or absolute time range modifier. A macro does not have to contain only a portion of the search, but can contain multiple parts of the search.

• Question 165:

  Which one of the following statements about the search command is true?

  A. It does not allow the use of wildcards.

  B. It treats field values in a case-sensitive manner.

  C. It can only be used at the beginning of the search pipeline.

  D. It behaves exactly like search strings before the first pipe.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Search/Usethesearchcomm and

  The search command is used to filter or refine your search results based on a search string that matches the events2. The search command behaves exactly like search strings before the first pipe, which means that you can use the same syntax and operators as you would use in the initial part of your search2. Therefore, option D is correct, while options A, B and C are incorrect because they are not true statements about the search command.

• Question 166:

  When creating a Search workflow action, which field is required?

  A. Search string

  B. Data model name

  C. Permission setting

  D. An eval statement

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Setupasearchworkflowacti on

  A workflow action is a link that appears when you click an event field value in your search results2. A workflow action can open a web page or run another search based on the field value2. There are two types of workflow actions: GET and POST2. A GET workflow action appends the field value to the end of a URI and opens it in a web browser2. A POST workflow action sends the field value as part of an HTTP request to a web server2. When creating a Search workflow action, which is a type of GET workflow action that runs another search based on the field value, the only required field is the search string2. The search string defines the search that will be run when the workflow action is clicked2. Therefore, option A is correct, while options B, C and D are incorrect because they are not required fields for creating a Search workflow action.

• Question 167:

  What does the fillnull command replace null values with, it the value argument is not specified?

  A. 0

  B. N/A

  C. NaN

  D. NULL

  Correct Answer: A

  Reference: https://answers.splunk.com/answers/653427/fillnull-doesnt-work-without- specfying-a-field.html

  The fillnull command is a search command that replaces null values with a specified value or 0 if no value is specified. Null values are values that are missing, empty, or undefined in Splunk. The fillnull command can replace null values for all fields or for specific fields. The fillnull command can take an optional argument called value that specifies the value to replace null values with. If no value argument is specified, the fillnull command will replace null values with 0 by default.

• Question 168:

  Which of the following statements describe calculated fields? (select all that apply)

  A. Calculated fields can be used in the search bar.

  B. Calculated fields can be based on an extracted field.

  C. Calculated fields can only be applied to host and sourcetype.

  D. Calculated fields are shortcuts for performing calculations using the eval command.

  Correct Answer: ABD

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields

  Calculated fields are fields that are created by performing calculations on existing fields using the eval command. Calculated fields can be used in the search bar to filter and transform events based on the calculated values. Calculated fields can also be based on an extracted field, which is a field that is extracted from raw data using various methods, such as regex, delimiters, lookups, etc. Calculated fields are not shortcuts for performing calculations using the eval command, but rather results of performing calculations using the eval command. Calculated fields can be applied to any field in Splunk, not only host and sourcetype.

  Therefore, statements A, B, and D are true about calculated fields.

• Question 169:

  Which of the following Statements about macros is true? (select all that apply)

  A. Arguments are defined at execution time.

  B. Arguments are defined when the macro is created.

  C. Argument values are used to resolve the search string at execution time.

  D. Argument values are used to resolve the search string when the macro is created.

  Correct Answer: BC

  A macro is a way to save a commonly used search string as a variable that you can reuse in other searches1. When you create a macro, you can define arguments that are placeholders for values that you specify at execution time1. The argument values are used to resolve the search string when the macro is invoked, not when it is created1. Therefore, statements B and C are true, while statements A and D are false.

• Question 170:

  Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

  

  A. The macro name is sessiontracker and the arguments are action, JESSIONID.

  B. The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

  C. The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

  D. The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

  Correct Answer: B

  Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros

  The macro definition below shows a macro that tracks user sessions based on two arguments: action and JSESSIONID.

  sessiontracker(2)

  The macro definition does the following:

  It specifies the name of the macro as sessiontracker. This is the name that will be used to execute the macro in a search string. It specifies the number of arguments for the macro as 2. This indicates that the macro takes two arguments when

  it is executed.

  It specifies the code for the macro as index=main sourcetype=access_combined_wcookie action=$action$ JSESSIONID=$JSESSIONID$ | stats count by JSESSIONID. This is the search string that will be run when the macro is executed. The search string can contain any part of a search, such as search terms, commands, arguments, etc. The search string can also include variables for the arguments using dollar signs around them. In this case, action and JSESSIONID are variables for the arguments that will be replaced by their values when the macro is executed.

  Therefore, to correctly configure the macro, you should enter sessiontracker as the name and action, JSESSIONID as the arguments. Alternatively, you can use sessiontracker(2) as the name and leave the arguments blank.