Splunk SPLK-1002 Online Practice Questions and Exam Preparation

Splunk SPLK-1002 Online Questions & Answers

• Question 301:

  What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

  A. There is a limit to the number of fields that can be extracted.
  B. The user is unable to preview the extractions.
  C. The extraction is added at index time.
  D. The user is unable to return to the automatic field extraction workflow.
  A. There is a limit to the number of fields that can be extracted.

• Question 302:

  A space is an implied _____ in a search string.

  A. OR
  B. AND
  C. ()
  D. NOT
  B. AND

  ---

  Explanation

  A space is an implied AND in a search string, which means that it acts as a logical operator that returns events that match both terms on either side of the space. For example, status=200 method=GET will return events that have both status=200 and method=GET. Therefore, option B is correct, while options A, C and D are incorrect because they are not implied by a space in a search string.

• Question 303:

  Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* | fields action productId status

  A. Looks for all events that include the fields: action, productId, and status.
  B. Uses the fields command to improve performance.
  C. Limits the fields that are extracted.
  D. Returns a table with 3 columns
  C. Limits the fields that are extracted.

• Question 304:

  Which of the following can a field alias be applied to?

  A. Indexes
  B. Tags
  C. Event types
  D. Sourcetypes
  D. Sourcetypes

  ---

  Explanation

  Field aliases are applied based on host, source, or sourcetype.

  Extract: "Create field aliases by specifying the host, source, or sourcetype that the alias applies to." Thus, the correct answer is Sourcetypes.

• Question 305:

  When should you use the transaction command instead of the scats command?

  A. When you need to group on multiple values.
  B. When duration is irrelevant in search results. .
  C. When you have over 1000 events in a transaction.
  D. When you need to group based on start and end constraints.
  D. When you need to group based on start and end constraints.

  ---

  Explanation

  The transaction command is used to group events into transactions based on some common characteristics, such as fields, time, or both. The transaction command can also specify start and end constraints for the transactions, such as a field value that indicates the beginning or the end of a transaction. The stats command is used to calculate summary statistics on the events, such as count, sum, average, etc. The stats command cannot group events based on start and end constraints, but only on fields or time buckets.

  Therefore, the transaction command should be used instead of the stats command when you need to group events based on start and end constraints.