SPLK-1002 Practice Exam Questions and Answers

A.  

chart

B.  

stats

C.  

xyseries

D.  

transaction

A.  

A pipe may always follow a macro.

B.  

The current user must own the macro.

C.  

The macro must be defined in the current app.

D.  

Only when sharing is set to global for the macro.

A.  

index=games I stats count as IP_count by IP

B.  

B.  

index=games | search IP_Count > 5

C.  

index=games | where IP > 5

D.  

index=games I search IP > 5

A.  

The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.

B.  

The CIM provides a methodology to normalize data from different sources and source types.

C.  

The CIM defines an ecosystem of apps that can be fully supported by Splunk.

D.  

The CIM is a data exchange initiative between software vendors.

A.  

index=web | stats sum (bytes) BY page BY server

B.  

index=web | stats sum (bytes) BY page server

C.  

index=web | stats sum(bytes) BY page AND server

D.  

index=web | stats sum(bytes) BY values (page) values (server)

A.  

Pivot, searches, and events.

B.  

Pivot, events, and transactions.

C.  

Searches, transactions, and pivot.

D.  

Events, searches, and transactions.

A.  

POST

B.  

Action

C.  

Search

D.  

Sub-Search

A.  

Tags

B.  

Extracted fields

C.  

Output fields for a lookup

D.  

Fields generated from a search string

A.  

The original field name is not affected by the creation of a field alias.

B.  

The original field name is replaced by the field alias within the index.

C.  

The original field name is italicized to indicate that it is not an alias.

D.  

The original field name still exists in the index but is not visible to the user at search time.

A.  

Search time

B.  

Index time

C.  

On a cron schedule

D.  

At midnight