Splunk Splunk Certifications SPLK-1002 Questions & Answers

• Question 221:

  Which of the following statements are true for this search? (Select all that apply.) SEARCH:

  sourcetype=access* |fields action productld status

  A. is looking for all events that include the search terms: fields AND action AND productld AND status

  B. users the table command to improve performance

  C. limits the fields are extracted

  D. returns a table with 3 columns

  Correct Answer: C

• Question 222:

  Which workflow action type performs a secondary search?

  A. POST

  B. Drilldown

  C. GET

  D. Search

  Correct Answer: D

  Explanation: The correct answer is D. Search.

  A workflow action is a knowledge object that enables a variety of interactions between fields in events and other web resources. Workflow actions can create HTML links, generate HTTP POST requests, or launch secondary searches based

  on field values1. There are three types of workflow actions that can be set up using Splunk Web: GET, POST, and Search2.

  GET workflow actions create typical HTML links to do things like perform Google searches on specific values or run domain name queries against external WHOIS databases2.

  POST workflow actions generate an HTTP POST request to a specified URI. This action type enables you to do things like creating entries in external issue management systems using a set of relevant field values2. Search workflow actions

  launch secondary searches that use specific field values from an event, such as a search that looks for the occurrence of specific combinations of ipaddress and http_status field values in your index over a specific time range2.

  Therefore, the workflow action type that performs a secondary search is Search.

  References:

  Splexicon:Workflowaction

  About workflow actions in Splunk Web

• Question 223:

  The fields sidebar does not show________. (Select all that apply.)

  A. interesting fields

  B. selected fields

  C. all extracted fields

  Correct Answer: C

  Explanation: The fields sidebar is a panel that shows the fields that are present in your search results2. The fields sidebar does not show all extracted fields, which are fields that are extracted from your raw data using various methods such as regular expressions, delimiters or key-value pairs2. The fields sidebar only shows selected fields and interesting fields2. Selected fields are fields that you choose to display in your search results by clicking on them in the fields sidebar or by using the fields command2. Interesting fields are fields that appear in at least 20 percent of events or have high variability among values2. Therefore, option C is correct, while options A and B are incorrect because they are types of fields that the fields sidebar does show.