Summer Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the Splunk Core Certified Power User SPLK-1002 Questions and answers with Dumpstech

Exam SPLK-1002 Premium Access

View all detail and faqs for the SPLK-1002 exam

Go to Exam

Practice at least 50% of the questions to maximize your chances of passing.

Viewing page 2 out of 10 pages

Viewing questions 11-20 out of questions

Questions # 11:

When is a GET workflow action needed?

Options:

To send field values to an external resource.

To retrieve information from an external resource.

To use field values to perform a secondary search.

To define how events flow from forwarders to indexes.

Questions # 12:

These allow you to categorize events based on search terms.

Select your answer.

Options:

Groups

Event Types

Macros

Options:

The macro name is sessiontracker and the arguments are action, JESSIONID.

The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

Questions # 14:

If there are fields in the data with values that are " " or empty but not null, which of the following would add a value?

Options:

| eval notNULL = if(isnull (notNULL), “0” notNULL)

| eval notNULL = if(isnull (notNULL), “0”

| eval notNULL = “” | nullfill value=0 notNULL

| eval notNULL = “” fillnull value=0 notNULL

Questions # 15:

What happens to the original field name when a field alias is created?

Options:

The original field name is not affected by the creation of a field alias.

The original field name is replaced by the field alias within the index.

The original field name is italicized to indicate that it is not an alias.

The original field name still exists in the index but is not visible to the user at search time.

Questions # 16:

Marty has multiple data sources that contain fields with IP Address values. What knowledge object should he use to normalize the fields so his data is CIM compliant?

Options:

Event type

Field alias

Field extraction

Tag

Questions # 17:

Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Options:

CIM is a methodology for normalizing data.

CIM can correlate data from different sources.

The Knowledge Manager uses the CIM to create knowledge objects.

CIM is an app that can coexist with other apps on a single Splunk deployment.

Questions # 18:

Consider the following search:

Index=web sourcetype=access_combined

The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Options:

index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID

index=web sourcetype=access_combined JSESSIONID < SD404K289O2F151 >

index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151

index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151

Questions # 19:

Which of the following commands support the same set of functions?

Options:

stats, eval, table

search, where, eval

stats, chart, timechart

transaction, chart, timechart

Questions # 20:

Which of the following describes the I transaction command?

Options:

It is an SPL command that groups at least two events together based on shared values in selected fields.

It allows an exchange of data from one Splunk index to another Splunk index.

It is an SPL command that groups events together with shared values in selected fields.

It allows an exchange of data from one Splunk system to another Splunk system.

Viewing page 2 out of 10 pages

Viewing questions 11-20 out of questions