Splunk Core Power User Exam (Questions And Answers) Rated A+

A calculated field maybe based on which of the following? A. Lookup tables B. Extracted fields C. Regular expressions D. Fields generated within a search string - ANSWER: B A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results? A. Both will appear in the All Fields list, but only if the alias is specified in the search. B. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events. C. The original field only appears in All Fields list and the alias only appears in the Interesting Fields list. D. the alias only appears in the All Fields list and the original field only appears in the Interesting Fields list - ANSWER: B A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____. A. skipped or deferred B. automatically accelerated C. deleted D. all of the above - ANSWER: A A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?A. It doesn't matter whether eval or sort is used first. B. Convert the numeric to a string with eval first, then sort. C. Use sort first, then convert the numeric to a string with eval. D. You cannot use the sort command and the eval command on the same field. - ANSWER: B