,SPLK 1002 Splunk Core Certified Power User Questions and Answers Focus
on Your Success
Regarding the search command, which of the following statements is accurate?
A. It does not allow the use of wildcards.
B. It treats field values in a case-sensitive manner.
C. It can only be used at the beginning of the search pipeline.
D. It behaves exactly like search strings before the first pipe.
Answer: D. It behaves exactly like search strings before the first pipe.
Which of the following tasks is possible with the eval command?
A. Remove fields from results.
B. Create or replace an existing field.
C. Group transactions by one or more fields.
D. Save SPL commands to be reused in other searches.
Answer: B. Create or replace an existing field.
When can a pipe follow a macro?
A. A pipe may always follow a macro.
B. The current user must own the macro.
C. The macro must be defined in the current app.
D. Only when sharing is set to global for the macro.
Answer: A. A pipe may always follow a macro.
Which of the following datasets makes up one or more of the data models? (Choose all that apply.)
A. Events datasets
B. Search datasets
C. Transaction datasets
D. Any child of event, transaction, and search datasets
Answer:
2
, A. Events datasets
B. Search datasets
C. Transaction datasets
Which of the following delimiters will function when using the Field Extractor (FX)? (Choose all that apply.)
A. Tabs
B. Pipes
C. Colons
D. Spaces
Answers:
A. Tabs
B. Pipes
D. Spaces
Which group of users would most likely use pivots?
A. Users
B. Architects
C. Administrators
D. Knowledge Managers
Answer: A. Users
What affects the event's displayed color when different event types with varying color values are assigned to
the same event?
A. Rank
B. Weight
C. Priority
D. Precedence
Answer: C. Priority
According to the macro's definition shown below, how should the macro be executed in a search string?
A."convert_sales(euro,€,.79)"
B. 'convert_sales(euro,€,.79)'
3
on Your Success
Regarding the search command, which of the following statements is accurate?
A. It does not allow the use of wildcards.
B. It treats field values in a case-sensitive manner.
C. It can only be used at the beginning of the search pipeline.
D. It behaves exactly like search strings before the first pipe.
Answer: D. It behaves exactly like search strings before the first pipe.
Which of the following tasks is possible with the eval command?
A. Remove fields from results.
B. Create or replace an existing field.
C. Group transactions by one or more fields.
D. Save SPL commands to be reused in other searches.
Answer: B. Create or replace an existing field.
When can a pipe follow a macro?
A. A pipe may always follow a macro.
B. The current user must own the macro.
C. The macro must be defined in the current app.
D. Only when sharing is set to global for the macro.
Answer: A. A pipe may always follow a macro.
Which of the following datasets makes up one or more of the data models? (Choose all that apply.)
A. Events datasets
B. Search datasets
C. Transaction datasets
D. Any child of event, transaction, and search datasets
Answer:
2
, A. Events datasets
B. Search datasets
C. Transaction datasets
Which of the following delimiters will function when using the Field Extractor (FX)? (Choose all that apply.)
A. Tabs
B. Pipes
C. Colons
D. Spaces
Answers:
A. Tabs
B. Pipes
D. Spaces
Which group of users would most likely use pivots?
A. Users
B. Architects
C. Administrators
D. Knowledge Managers
Answer: A. Users
What affects the event's displayed color when different event types with varying color values are assigned to
the same event?
A. Rank
B. Weight
C. Priority
D. Precedence
Answer: C. Priority
According to the macro's definition shown below, how should the macro be executed in a search string?
A."convert_sales(euro,€,.79)"
B. 'convert_sales(euro,€,.79)'
3
