Splunk splk-1002 practice test

Question 1

Calculated fields can be based on which of the following?
A. Tags
B. Extracted fields
C. Output fields for a lookup
D. Fields generated from a search string

Question 2

Which of the following eval command functions is valid?
A. int()
B. count()
C. print()
D. tostring()

Question 3

Which of the following statements describes the use of the Field Extractor (FX)?

• A. The Field Extractor automatically extracts all fields at search time.
• B. The Field Extractor uses PERL to extract fields from the raw events.
• C. Fields extracted using the Field Extractor persist as knowledge objects.
• D. Fields extracted using the Field Extractor do not persist and must be defined for each search.

Question 4

Which of the following searches show a valid use of a macro? (Choose all that apply.)

• A. index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField
• B. index=main source=mySource oldField=* | stats if(makeMyField(oldField)) | table _time newField
• C. index=main source=mySource oldField=* | eval newField=makeMyField(oldField)| table _time newField
• D. index=main source=mySource oldField=* | "newField(makeMyField(oldField))" | table _time newField

Question 5

What is the correct format for naming a macro with multiple arguments?

• A. monthly_sales(argument 1, argument 2, argument 3)
• B. monthly_sales(3)
• C. monthly_sales[3]
• D. monthly_sales[argument 1, argument 2, argument 3)

Question 6

Which statement is true?

• A. Pivot is used for creating datasets.
• B. Data models are randomly structured datasets.
• C. Pivot is used for creating reports and dashboards.
• D. In most cases, each Splunk user will create their own data model.

Question 7

What is the Splunk Common Information Model (CIM)?

• A. The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.
• B. The CIM provides a methodology to normalize data from different sources and source types.
• C. The CIM defines an ecosystem of apps that can be fully supported by Splunk.
• D. The CIM is a data exchange initiative between software vendors.

Question 8

How is a Search Workflow Action configured to run at the same time range as the original search?

• A. Set the earliest time to match the original search.
• B. Select the same time range from the time-range picker.
• C. Select the "Use the same time range as the search that created the field listing" checkbox.
• D. Select the "Overwrite time range with the original search" checkbox.

Question 9

What does the fillnull command replace null values with, if the value argument is not specified?

• A. 0
• B. N/A
• C. NaN
• D. NULL

Question 10

Which of the following searches will return events containing a tag named Privileged?

• A. tag=Priv
• C. tag=priv*
• D. tag=privileged

Question 11

Data models are composed of one or more of which of the following datasets? (select all that apply)
A. Transaction datasets
B. Events datasets
C. Search datasets
D. Any child of event, transaction, and search datasets

Question 12

Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the
events as a group. From the following list, which search groups events by JSESSIONID?

• A. index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID
• B. index=web sourcetype=access_combined JSESSIONID <SD404K289O2F151>
• C. index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151
• D. index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151

Question 13

What happens when a user edits the regular expression (regex) field extraction generated in the Field
Extractor (FX)?

• A. There is a limit to the number of fields that can be extracted.
• B. The user is unable to preview the extractions.
• C. The extraction is added at index time.
• D. The user is unable to return to the automatic field extraction workflow.

Question 14

Which of the following is one of the pre-configured data models included in the Splunk Common
Information Model (CIM) add-on?

• A. Access
• B. Accounting
• C. Authorization
• D. Authentication

Question 15

Which of the following statements describes calculated fields?

• A. Calculated fields are only used on fields added by lookups.
• B. Calculated fields are a shortcut for repetitive and complex eval commands.
• C. Calculated fields are a shortcut for repetitive and complex calc commands.
• D. Calculated fields automatically calculate the simple moving average for indexed fields.