Free Splunk Core Certified Power User Exam Practice Questions

A.  

... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)

B.  

There is no equivalent expression using fillnull

C.  

... | fillnull field1 | fillnull value="NO-VALUE" field2

D.  

... | fillnull value=0 field1 | fillnull field2

A.  

Fields generated within a search string

B.  

Lookup tables

C.  

Regular expressions

D.  

Extracted fields

A.  

Rename a field in the index

B.  

remove duplicate values

C.  

provide an additional alias for the field that can

D.  

A.  

POST workflow actions are always encrypted.

B.  

POST workflow actions cannot use field values in their URI.

C.  

POST workflow actions cannot be created on custom sourcetypes.

D.  

POST workflow actions can open a web page in either the same window or a new .

A.  

Set the values of the field to null when it is "Unknown".

B.  

Set all fields that are null to "Unknown".

C.  

Set the values of the field to "Unknown" if it is null.

D.  

Set all fields with the value of "Unknown" to null.

A.  

Table

B.  

Report

C.  

Pie chart

A.  

A macro is a reusable search string that must contain the full search.

B.  

A macro is a reusable search string that must have a fixed time range.

C.  

A macro Is a reusable search string that may have a flexible time range.

D.  

A macro Is a reusable search string that must contain only a portion of the search.

A.  

status

B.  

host

C.  

count

A.  

By using the macroname command.

B.  

By using the macro command.

C.  

By enclosing the macro name in backtick characters (‘).

D.  

By enclosing the macro name in single-quote characters (‘).

A.  

in real-time

B.  

on a regular schedule

C.  

and have no matching events