SPLK-1002 Practice Questions

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Which group of users would most likely use pivots?

When using timechart, how many fields can be listed after a by clause?

What is the correct syntax to search for a tag associated with a value on a specific fields?

What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

When should you use the transaction command instead of the scats command?

Which of the following statements describes field aliases?

What does the following search do? index=corndog type= mysterymeat action=eaten | stats count as corndog_count by user

Which of the following statements describes Search workflow actions?

What do events in a transaction have In common?

Which of the following statements describe GET workflow actions?

Data model are composed of one or more of which of the following datasets? (select all that apply.)

In what order arc the following knowledge objects/configurations applied?

Which of the following knowledge objects represents the output of an eval expression?

A calculated field maybe based on which of the following?

Which of the following eval command function is valid?

Which one of the following statements about the search command is true?

What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Which of the following file formats can be extracted using a delimiter field extraction?

Which of the following statements describes macros?

Which of the following statements describe calculated fields? (select all that apply)

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Which of the following statements is true, especially in large environments?

Which of the following are required to create a POST workflow action?

Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

After manually editing; a regular expression (regex), which of the following statements is true?

What does the fillnull command replace null values with, it the value argument is not specified?

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Which of the following actions can the eval command perform?

Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

When creating a Search workflow action, which field is required?

Selected fields are displayed ______each event in the search results.

A space is an implied _____ in a search string.

Which of the following search control will not re-rerun the search? (Select all that apply.)

Highlighted search terms indicate _________ search results in Splunk.

When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied. (Select all that apply).

The time range specified for a historical search defines the ____________ .------questionable on ans

Using the export function, you can export search results as __________.( Select all that apply)

The fields sidebar does not show________. (Select all that apply.)

Splunk alerts can be based on search that run______. (Select all that apply.)

Which of the following about reports is/are true?

Select this in the fields sidebar to automatically pipe you search results to the rare command

A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Which of the following are valid options to speed up reports? (Select all the apply.)

Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Use the dedup command to _____.

We can use the rename command to _____ (Select all that apply.)

The limit attribute will___________.