SPLK-1002 Practice Questions

A.  

Select an additional sample event with the Field Extractor (FX) and highlight the missing value in the event.

B.  

Re-ingest the data and attempt to extract from a new dataset.

C.  

Click on the event where the field was not extracted and choose “Change to Delimited".

D.  

Edit the regular expression manually.

A.  

Calculated fields can be used in the search bar.

B.  

Calculated fields can be based on an extracted field.

C.  

Calculated fields can only be applied to host and sourcetype.

D.  

Calculated fields are shortcuts for performing calculations using the eval command.

A.  

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

B.  

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

C.  

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

D.  

None of these searches would generate a similart graph.

A.  

The chart command does not allow for multiple statistical functions.

B.  

Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase

C.  

Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

D.  

Count: product, sum: product, count: action, sum: action

A.  

chart sales by product_name

B.  

chart sum(price) as sales by product_name

C.  

stats sum(price) as sales over product_name

D.  

timechart list(sales), values(product_name)

A.  

Set the values of the src field to null when it is "Unknown".

B.  

Set all fields that are null to "Unknown".

C.  

Set the values of the src field to "Unknown" if it is null.

D.  

Set all fields with the value of "Unknown" to null.

A.  

A Run workflow action, because the user is running a new search with a specific field value from an event returned in the user's search.

B.  

A Search workflow action, because the user is running a new search with a specific field value from an event returned in the user's search.

C.  

A POST workflow action, because the search is being sent to the user's current Splunk instance.

D.  

A GET workflow action, because a field value needs to be retrieved from the events returned in the user's search.

A.  

Eval fields

B.  

Calculated fields

C.  

Field extractions

D.  

Calculated lookups

A.  

duration=5m

B.  

bin=5m

C.  

earliest=-5m

D.  

maxspan=5m

A.  

Examplemacro [1,2]

B.  

samplemacro(1,2)

C.  

u amp -CJEUCXG (2)

D.  

samplemacro[2]