SPLK-1002 by Splunk Actual Free Exam Questions And Answers

Question 1

Which of the following options will define the first event in a transaction?

A. with

B. firstevent

C. startingwith

D. startswith

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

The timechart command buckets data in time intervals depending on:

A. the number of events returned

B. the selected time range

C. the type of visualization selected

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)

A. | chart count over CurrentStanding by Action limit=10 useother=f

B. | chart count over CurrentStanding by Action usenull-f useother-t

C. | chart count over CurrentStanding by Action limit-10

D. | chart count over CurrentStanding by Action useother=f

Discussion 0

Correct Answer: A,D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

Which search string would only return results for an event type called success ful_purchases?

A. event type-success ful_purchases

B. successful_purchases

C. tag=success ful_purchases

D. Event Type:: successful purchases

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

What does the fillnull command do in this search?
index=main sourcetype=http:log | fillnull value="Unknown"

A. Set all fields that are null to "Unknown".

B. Set all fields with the value of "Unknown" to null.

C. Set the values of the field to null when it is "Unknown".

D. Set the values of the field to "Unknown" if it is null.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

Which of the following eval commands will provide a new value for host from src if it exists?

A. | eval host = if (isnotnull (src), src, host)

B. | eval host = if (isnu11 (src), src, host)

C. | eval host = if (src = host, src, host)

D. | eval host = if (NOT src = host, src, host)

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 7

These users can create global knowledge objects. (Select all that apply.)

A. power users

B. users

C. administrators

Discussion 0

Correct Answer: A,C Vote an answer

Question 8

Which of the following searches would return a report of sales by product-name?

A. chart sales by product_name

B. chart sum(price) as sales by product_name

C. stats sum(price) as sales over product_name

D. timechart list(sales), values(product_name)

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

What does the following search do?

A. Creates a table of the total count of mysterymeat corndogs split by user.

B. Creates a table with the count of all types of corndogs eaten split by user.

C. Creates a table that groups the total number of users by vegetarian corndogs.

D. Creates a table of the total count of users and split by corndogs.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 10

Which of the following is true about data model attributes?

A. They can only be added into a root search dataset.

B. They can be added to a dataset from search time field extractions.

C. They cannot be created within the data model.

D. They cannot be edited if inherited from a parent dataset.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 11

Consider the the following search run over a time range of last 7 days:
index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane Which option is used to change the default time span so that results are grouped into 12 hour intervals?

A. span=12h

B. span=12

C. timespan=12h

D. timespan=12

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 12

In which of the following scenarios is an event type more effective than a saved search?

A. When a search needs to be added to other users' dashboards.

B. When formatting needs to be included with the search string.

C. When a search should always include the same time range.

D. When the search string needs to be used in future searches.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 13

Two separate results tables are being combined using the join command. The outer table has the following values:
The inner table has the following values:

The line of SPL used to join the tables is: join employeeNumber type=outer How many rows are returned in the new table?

A. Three

B. Zero

C. Five

D. Eight

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 14

When using the timechart command, how can a user group the events into buckets based on time?

A. Using the interval argument.

B. Adjusting the fieldformat options.

C. Using the span argument.

D. Using the duration argument.

Discussion 0

Correct Answer: C Vote an answer

Question 15

A user runs the following search:
index-X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother-f Which of the following table headers match the order this command creates?

A. Count: product, sum: product, count: action, sum: action

B. Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

C. Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase

D. The chart command does not allow for multiple statistical functions.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Splunk Core Certified Power User - SPLK-1002 Exam Practice Test

Contact Us

Useful Links

Latest Updated