Exam (elaborations)
SPLUNK SPLK 1002 Test with Questions and 100% Correct Answers
- Course
- Institution
SPLUNK SPLK 1002 Test with Questions and 100% Correct Answers
[Show more]
Seller
Follow
Content preview
SPLUNK SPLK 1002 Test with Questions and 100%Correct Answers
Which of the following searches will return events containing a tag named Privileged?
A. tag=Priv
B. tag=Priv*
C. tag=priv*
D. tag=privileged - Answer B. tag=Priv*
Given the macro definition below, what should be entered into the Name and
Arguments fields to correctly configure the macro?
A. The macro name is sessiontracker and the arguments are action, JESSIONID.
B. The macro name is sessiontracker(2) and the arguments are action, JESSIONID.
C. The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.
D. The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$. -
Answer B. The macro name is sessiontracker(2) and the arguments are action, JESSIONID.
What is required for a macro to accept three arguments?
A. The macro's name ends with (3).
,B. The macro's name starts with (3).
C. The macro's argument count setting is 3 or more.
D. Nothing, all macros can accept any number of arguments. - Answer A. The macro's
name ends with (3).
Which workflow action method can be used when the action type is set to link?
A. GET
B. PUT
C. Search
D. UPDATE - Answer A. GET (Post also uses link)
Which of the following statements about tags is true? (Choose all that apply.)
A. Tags are case-insensitive.
B. Tags are based on field/value pairs.
C. Tags categorize events based on a search.
D. Tags are designed to make data more understandable. - Answer B. Tags are based on
field/value pairs.
D. Tags are designed to make data more understandable.
Which of the following statements about macros is true? (Choose all that apply.)
A. Arguments are defined at execution time.
B. Arguments are defined when the macro is created.
C. Argument values are used to resolve the search string at execution time.
D. Argument values are used to resolve the search string when the macro is created. -
Answer B. Arguments are defined when the macro is created.
C. Argument values are used to resolve the search string at execution time.
,Information needed to create a GET workflow action includes which of the following?
(Choose all that apply.)
A. A name for the workflow action.
B. A URI where the user will be directed at search time.
C. A label that will appear in the Event Action menu at search time.
D. A name for the URI where the user will be directed at search time. - Answer A. A
name for the workflow action.
B. A URI where the user will be directed at search time.
C. A label that will appear in the Event Action menu at search time.
Which of the following can be used with the eval command tostring function? (Choose
all that apply.)
A. "hex"
B. "commas"
C. "decimal"
D. "duration" - Answer A. "hex"
B. "commas"
D. "duration"
Which of the following searches show a valid use of a macro? (Choose all that apply.)
A. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time
newField
B. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table
_time newField
C. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'|
table _time newField
D. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" |
table _time newField - Answer A. index=main source=mySource oldField=*
|'makeMyField(oldField)'| table _time newField
, B. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table
_time newField
A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?
A. It doesn't matter whether eval or sort is used first.
B. Convert the numeric to a string with eval first, then sort.
C. Use sort first, then convert the numeric to a string with eval.
D. You cannot use the sort command and the eval command on the same field. - Answer
C. Use sort first, then convert the numeric to a string with eval.
Which Knowledge Object does the Splunk Common Information Model (CIM) use to
normalize data, in addition to field aliases, event types, and tags? - Answer B. Lookups
(Most Correct Option)
D. Field extractions
Which of the following statements describe data model acceleration? (Choose all that
apply.)
A. Root events cannot be accelerated.
B. Accelerated data models cannot be edited.
C. Private data models cannot be accelerated.
D. You must have administrative permissions or the accelerate_datamodel capability to
accelerate a data model. - Answer B. Accelerated data models cannot be edited.
C. Private data models cannot be accelerated.
D. You must have administrative permissions or the accelerate_datamodel capability to
accelerate a data model.
How does a user display a chart in stack mode?
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller KenAli. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $13.49. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
79373 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now