[Aug-2021] Get 100% Real SPLK-1002 Exam Questions, Accurate & Verified PassLeader Dumps in the Real Exam!
Pass Your Splunk Core Certified Power User Exams Fast. All Top SPLK-1002 Exam Questions Are Covered.
NEW QUESTION 80
Which of the following statements about data models and pivot are true? (select all that apply)
- A. Pivot requires users to input SPL searches on data models.
- B. They are both knowledge objects.
- C. Data models are created out of datasets called pivots.
- D. Pivot allows the creation of data visualizations that present different aspects of a data model.
Answer: C,D
NEW QUESTION 81
Which of the following is a function of the Splunk Common Information Model (CIM)?
- A. Reingesting previously indexed data with new field names.
- B. Normalizing data across a Splunk deployment.
- C. Algorithmically shifting events to other indexes.
- D. Providing templates for reports and dashboards.
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/CIM/4.18.0/User/Overview
NEW QUESTION 82
Which workflow action method can be used the action type is set to link?
- A. GET
- B. UPDATE
- C. Search
- D. PUT
Answer: A
Explanation:
Explanation
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps
* Navigate to Settings > Fields
* Click New to open up a new workflow action form.
* Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu.
Labels can be static or include the value of relevant fields.
* Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
* For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
* Set Action type to link.
* In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
* Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
* Set the Link method to get
* Click Save to save your workflow action definition.
NEW QUESTION 83
Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)
- A. Auto-Extracted fields can be added if they already exist in the dataset with constraints.
- B. Auto-Extracted fields can be given a friendly name for use in Pivot.
- C. Auto-Extracted fields can have their data type changed.
- D. Auto-Extracted fields can be hidden in Pivot.
Answer: A,B,C,D
NEW QUESTION 84
Which of the following searches show a valid use of macro? (Select all that apply)
- A. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
- B. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
- C. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
- D. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
Answer: B,C
Explanation:
Reference:
https://answers.splunk.com/answers/574643/field-showing-an-additional-and-not-visible-value-1.html
NEW QUESTION 85
When should transaction be used?
- A. Only in a large distributed Splunk environment.
- B. When calculating results from one or more fields.
- C. When grouping events results in over 1000 events in each group.
- D. When event grouping is based on start/end values.
Answer: B
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Abouttransactions
NEW QUESTION 86
After manually editing a regular expression (regex), which of the following statements is true?
- A. The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.
- B. Changes made manually can be reverted in the Field Extractor (FX) UI.
- C. It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.
- D. It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.
Answer: A
Explanation:
Explanation
NEW QUESTION 87
When creating a Search workflow action, which field is required?
- A. An eval statement
- B. Data model name
- C. Permission setting
- D. Search string
Answer: D
NEW QUESTION 88
When using| timechart by host, which field is represented in the x-axis?
- A. _time
- B. date
- C. host
- D. time
Answer: D
Explanation:
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Timechart
NEW QUESTION 89
Which of the following search control will not re-rerun the search? (Select all that apply.)
- A. zoom out
- B. deselect
- C. selecting a range of bars on the timelines
- D. selecting a bar on the timeline
Answer: B,C,D
NEW QUESTION 90
The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization.
If another person in the organization runs the shared report and no results are returned, why might this be?
(Choose all that apply.)
- A. The dashboard is private.
- B. The person in the organization running the report does not have access to the index.
- C. The extraction is private.
- D. Fast mode is enabled.
Answer: B,C
Explanation:
Explanation/Reference:
NEW QUESTION 91
In which of the following scenarios is an event type more effective than a saved search?
- A. When the search string needs to be used in future searches.
- B. When formatting needs to be included with the search string.
- C. When a search should always include the same time range.
- D. When a search needs to be added to other users' dashboards.
Answer: B
Explanation:
Reference:https://answers.splunk.com/answers/4993/eventtype-vs-saved-search.html
NEW QUESTION 92
Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?
- A. index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID
- B. index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151
- C. index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151
- D. index=web sourcetype=access_combined JSESSIONID <SD404K289O2F151>
Answer: D
NEW QUESTION 93
Which workflow action method can be used the action type is set to link?
- A. GET
- B. UPDATE
- C. Search
- D. PUT
Answer: A
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps
* Navigate to Settings > Fields > Workflow Actions.
* Click New to open up a new workflow action form.
* Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu. Labels can be static or include the value of relevant fields.
* Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
* For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
* Set Action type to link.
* In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
* Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
* Set the Link method to get.
* Click Save to save your workflow action definition.
NEW QUESTION 94
To identify all of the contributing events within a transaction that contain at least one REJECTevent, which syntax is correct?
- A. index=main | transaction sessionid | search REJECT
- B. index=main REJECT | transaction sessionid
- C. index=main | transaction sessionid | where transaction="REJECT*"
- D. index=main | transaction sessionid | where transaction=reject
Answer: A
NEW QUESTION 95
When using timechart, how many fields can be listed after a by clause? ( Choose Two )
- A. because timechart doesn't support using a by clause.
- B. because one field would represent the x-axis and the other would represent the y-axis.
- C. There is no limit specific to timechart.
- D. because _time is already implied as the x-axis.
Answer: C,D
NEW QUESTION 96
What is a limitation of searches generated by workflow actions?
- A. Searches generated by workflow action must run in the same app as the workflow action.
- B. Searches generated by workflow actions must be less than 256 characters long.
- C. Searches generated by workflow action cannot use macros.
- D. Searches generated by workflow action run with the same permissions as the user running them.
Answer: D
NEW QUESTION 97
Which of the following searches show a valid use of macro? (Select all that apply)
- A. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
- B. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
- C. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
- D. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
Answer: B,C
NEW QUESTION 98
Historical searches provide a static snapshot of events at a given time.
- A. True
- B. False
Answer: A
NEW QUESTION 99
A data model consists of which three types of datasets?
- A. Transaction, session ID, metadata.
- B. Events, searches, transactions.
- C. Field extraction, regex, delimited.
- D. Constraint, field, value.
Answer: B
Explanation:
The building block of a data model. Each data model is composed of one or more data model datasets. Each dataset within a data model defines a subset of the dataset represented by the data model as a whole.
Data model datasets have a hierarchical relationship with each other, meaning they have parent-child relationships. Data models can contain multiple dataset hierarchies. There are three types of dataset hierarchies: event, search, and transaction.
https://docs.splunk.com/Splexicon:Datamodeldataset
NEW QUESTION 100
A real-time alert is ______________.
- A. constantly running in the background
- B. A scheduled alert
Answer: A
NEW QUESTION 101
......
Penetration testers simulate SPLK-1002 exam: https://www.passleader.top/Splunk/SPLK-1002-exam-braindumps.html
Free Test Engine For Splunk Core Certified Power User Exam Certification Exams: https://drive.google.com/open?id=1T6M1gXrgALo5tRv4ZxlmlU5yFoqTobhx