Splunk SPLK-1002 Online Practice Questions and Exam Preparation

Splunk SPLK-1002 Online Questions & Answers

• Question 51:

  What is the Splunk Common Information Model (CIM)?

  A. The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.
  B. The CIM provides a methodology to normalize data from different sources and source types.
  C. The CIM defines an ecosystem of apps that can be fully supported by Splunk.
  D. The CIM is a data exchange initiative between software vendors.
  B. The CIM provides a methodology to normalize data from different sources and source types.

  ---

  Explanation

  The Splunk Common Information Model (CIM) provides a methodology to normalize data from different sources and source types. The CIM defines a common set of fields and tags for different types of data, such as web, network, email, etc.

  This allows you to search and analyze data from different sources in a consistent way.

• Question 52:

  When using the timechart command, how can a user group the events into buckets based on time?

  A. Using the span argument.
  B. Using the duration argument.
  C. Using the interval argument.
  D. Adjusting the fieldformat options.
  A. Using the span argument.

• Question 53:

  Field aliases are used to __________ data

  A. clean
  B. transform
  C. calculate
  D. normalize
  D. normalize

• Question 54:

  Which of the following objects can a calculated field use as a source?

  A. An alias of a field.
  B. A field added by an automatic lookup.
  C. The tag field.
  D. The eventtype field.
  B. A field added by an automatic lookup.

  ---

  Explanation

  The correct answer is B. A field added by an automatic lookup.

  A calculated field is a field that is added to events at search time by using an eval expression. A calculated field can use the values of two or more fields that are already present in the events to perform calculations. A calculated field can use any field as a source, as long as the field is extracted before the calculated field is defined. An automatic lookup is a way to enrich events with additional fields from an external source, such as a CSV file or a database.An automatic lookup can add fields to eventsbased on the values ofexisting fields, such as host, source, sourcetype, or any other extracted field. An automatic lookup is performed before the calculated fields are defined, so the fields added by the lookup can be used as sources for the calculated fields. Therefore, a calculated field can use a field added by an automatic lookup as a source.

  References:

  About calculated fields

  About lookups

  Search time processing

• Question 55:

  What fields does the transaction command add to the raw events? (select all that apply)

  A. count
  B. duration
  C. eventcount
  D. transaction id
  B. duration
  D. transaction id

  ---

  Explanation

  Hello, this is Bing. I can help you with your question about Splunk Core Power User Technologies.

  The correct answers are

  B. duration and

  D. transaction id. The explanation is as follows: The transaction command is a Splunk command that finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the_raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member. The transaction command adds some fields to the raw events that are part of the transaction. These fields are: Therefore, the fields that the transaction command adds to the raw events are duration and transaction_id, which are options B and D in your question.

• Question 56:

  When creating a search workflow action, what character(s) are used as a placeholder for field values in the search string?

  A. *
  B. ()
  C. $
  D. #
  C. $

  ---

  Explanation

  In workflow action definitions, field tokens are enclosed with dollar signs to represent field values dynamically.

  Extract: "In workflow actions, enclose field names with dollar signs ($fieldname$) to insert their values dynamically into URLs or searches."

• Question 57:

  Which method in the Field Extractor would extract the port number from the following event? |

  10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin <web error>

  A. Delimiter
  B. rex command
  C. The Field Extractor tool cannot extract regular expressions.
  D. Regular expression
  B. rex command

  ---

  Explanation

  The rex command allows you to extract fields from events using regular expressions. You can use the rex command to specify a named group that matches the port number in the event. For example:

  rex "\+\+\+\+port (?<port>\d+)"

  This will create a field called port with the value 54 for the event. The delimiter method is not suitable for this event because there is no consistent delimiter between the fields. The regular expression method is not a valid option for the Field Extractor tool. The Field Extractor tool can extract regular expressions, but it is not a method by itself.

  References:

  1 Splunk Core Certified Power User | Splunk

• Question 58:

  Which workflow action method can be used the action type is set to link?

  A. GET
  B. PUT
  C. Search
  D. UPDATE
  A. GET

  ---

  Explanation

  https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction

  Define a GET workflow action Steps Navigate to Settings > Fields > Workflow Actions.ClickNewtoopenupanewworkflowactionform.DefineaLabelfortheaction.TheLabelfieldenablesyoutodefinethetextthatisdisplayedineitherthefieldoreventworkflowmenu.Labelscanbestaticorincludethevalueofrelevantfields.Determinewhethertheworkflowactionappliestospecificfieldsoreventtypesinyourdata.UseApplyonlytothefollowingfieldstoidentifyoneormorefields.Whenyouidentifyfields,theworkflowactiononlyappearsforeventsthathavethosefields,eitherintheireventmenuorfieldmenus.Ifyouleaveitblankorenteranasterisktheactionappearsinmenusforallfields.UseApplyonlytothefollowingeventtypestoidentifyoneormoreeventtypes.Ifyouidentifyaneventtype,theworkflowactiononlyappearsintheeventmenusforeventsthatbelongtotheeventtype.ForShowactionindeterminewhetheryouwanttheactiontoappearintheEventmenu,theFieldsmenus,orBoth.SetActiontypetolink.InURIprovideaURIforthelocationoftheexternalresourcethatyouwanttosendyourfieldvaluesto.SimilartotheLabelsetting,whenyoudeclarethevalueofafield,youusethenameofthefieldenclosedbydollarsigns.VariablespassedinGETactionsviaURIsareautomaticallyURLencodedduringtransmission.Thismeansyoucanincludevaluesthathavespacesbetweenwordsorpunctuationcharacters.UnderOpenlinkin,determinewhethertheworkflowactiondisplaysinthecurrentwindoworifitopensthelinkinanewwindow.SettheLinkmethodtoget.ClickSavetosaveyourworkflowactiondefinition.

• Question 59:

  Which of the following searches would return a report of sales by product-name?

  A. chart sales by product_name
  B. chart sum(price) as sales by product_name
  C. stats sum(price) as sales over product_name
  D. timechart list(sales), values(product_name)
  B. chart sum(price) as sales by product_name

  ---

  Explanation

  https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Chart

  https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Stats

• Question 60:

  Highlighted search terms indicate _________ search results in Splunk.

  A. Display as selected fields.
  B. Sorted
  C. Charted based on time
  D. Matching
  D. Matching

  ---

  Explanation

  Highlighted search terms indicate matching search results in Splunk, which means that they show which parts of your events match your search string. For example, if you search for error OR fail,Splunk will highlight error or fail in your events to show which events match your search string. Therefore, option D is correct, while options A, B and C are incorrect because they are not indicated by highlighted search terms.