Free Splunk Core Certified Power User Exam Practice Questions

A.  

eval, coalesce

B.  

transaction, stats

C.  

stats, format

D.  

top, rare

A.  

events with this field

B.  

rare values

C.  

top values by time

D.  

top values

A.  

Three

B.  

Eight

C.  

Five

D.  

Zero

A.  

This is a valid search and will display a timechart of the average duration, of each transaction event.

B.  

This is a valid search and will display a stats table showing the maximum pause among transactions.

C.  

No results will be returned because the transaction command must include the startswith and endswith options.

D.  

No results will be returned because the transaction command must be the last command used in the search pipeline.

A.  

Multi-Series

B.  

Split-Series

C.  

Omit nulls

D.  

Stacked

A.  

Fields

B.  

Tokens

C.  

Advanced Search

D.  

Searches, Reports, Alerts

A.  

It doesn't matter whether eval or sort is used first.

B.  

Convert the numeric to a string with eval first, then sort.

C.  

Use sort first, then convert the numeric to a string with eval.

D.  

You cannot use the sort command and the eval command on the same field.

A.  

The regex can no longer be edited.

B.  

The field being extracted will be required for all future events.

C.  

The events without the required field will not display in searches.

D.  

Only events with the required string will be included in the extraction.

A.  

int()

B.  

count()

C.  

print()

D.  

tostring()

A.  

join

B.  

stats

C.  

streamstats

D.  

transaction