Free SPLK-1002 Questions for Splunk SPLK-1002 Exam

Question #1

Which group of users would most likely use pivots?

A. Architects

B. Administrators

C. Knowledge Managers

D. Users

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #2

How is an event type created from the search window? (select all that apply)

A. Edit eventtypes.conf and add a new stanza.

B. In the top right corner, click Save As > Event Type.

C. Add | eventtype to the SPL and execute the search.

D. In an event's detail dropdown, click Event Actions > Build Event Type.

Discussion 0

Correct Answer: A,B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #3

What type of command is eval?

A. Distributable streaming

B. Streaming in some modes

C. Report generating

D. Centralized streaming

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #4

Which of the following searches show a valid use of macro? (Select all that apply)

A. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

B. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField

C. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

D. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

Discussion 0

Correct Answer: A,D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #5

Which of the following describes the I transaction command?

A. It allows an exchange of data from one Splunk system to another Splunk system.

B. It is an SPL command that groups events together with shared values in selected fields.

C. It is an SPL command that groups at least two events together based on shared values in selected fields.

D. It allows an exchange of data from one Splunk index to another Splunk index.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #6

Which search would limit an "alert" tag to the "host" field?

A. host::tag::alert

B. tag::host=alert

C. tag=alert

D. tag==alert

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #7

Which of the following statements describes the use of the Filed Extractor (FX)?

A. The Field Extractor uses PERL to extract field from the raw events.

B. Field extracted using the Extracted persist as knowledge objects.

C. The Field Extractor automatically extracts all field at search time.

D. Fields extracted using the Field Extractor do not persist and must be defined for each search.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #8

Given the following eval statement:
... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2) Which of the following is the equivalent using fillnull?

A. ... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)

B. ... | fillnull value=0 field1 | fillnull field2

C. ... | fillnull field1 | fillnull value="NO-VALUE" field2

D. There is no equivalent expression using fillnull

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #9

There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

A. Fields sidebar > Extract New Field

B. Event Actions > Extract Fields

C. Settings > Field Extractions > New Field Extraction

D. Settings > Field Extractions > Open Field Extraction

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #10

What is a limitation of searches generated by workflow actions?

A. Searches generated by workflow action run with the same permissions as the user running them.

B. Searches generated by workflow action cannot use macros.

C. Searches generated by workflow action must run in the same app as the workflow action.

D. Searches generated by workflow actions must be less than 256 characters long.

Discussion 0

Correct Answer: A Vote an answer

Question #11

A user wants a table that will show the total revenue made for each product in each sales region. Which would be the correct SPL query to use?

A. index=X sourcetype=Y | chart sum(product) by price AND region

B. index=X | chart total(price) by product, region

C. index=X | chart total(product) over price by region

D. index=X | chart sum(price) by product, region

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #12

In the Field Extractor Utility, this button will display events that do not contain extracted fields.
Select your answer.

A. Non-Extractions

B. Non-Matches

C. Matches

D. Selected-Fields

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #13

Which of the following knowledge objects can reference field aliases?

A. Calculated fields and event types only.

B. Calculated fields and tags only.

C. Calculated fields, lookups, event types, and extracted fields.

D. Calculated fields, lookups, event types, and tags.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #14

Field aliases are used to __________ data

A. clean

B. normalize

C. calculate

D. transform

Discussion 0

Correct Answer: B Vote an answer

Free SPLK-1002 Questions for Splunk Core Certified Power User SPLK-1002 Exam as PDF & Practice Test Engine

Download Free Splunk SPLK-1002 Demo