Splunk - Core Power User Exam – DUMP || A Verified A+
Pass.
When performing a regular expression (regex) field extraction using the Field Extractor (FX),
what happens
when the require option is used?
A. The regex can no longer be edited.
B. The field being extracted will be required for all future events.
C. The events without the required field will not display in searches.
D. Only events with the required string will be included in the extraction. correct answers
ANSWER: D
Which of the following statements describe data model acceleration? (select all that apply)
A.Root events cannot be accelerated.
B.Accelerated data models cannot be edited.
C.Private data models cannot be accelerated.
D.You must have administrative permissions or the accelerate_dacamodel capability to
accelerate a data model. correct answers ANSWER: BCD
Which of the following are required to create a POST workflow action?
A. Label, URI, search string.
B. XMI attributes, URI, name.
C. Label, URI, post arguments.
D. URI, search string, time range picker. correct answers ANSWER: B
In which of the following scenarios is an event type more effective than a saved search?
A. When a search should always include the same time range.
B. When a search needs to be added to other users' dashboards.
C. When the search string needs to be used in future searches.
D. When formatting needs to be included with the search string. correct answers ANSWER: D
What does the following search do?
index=corndog type=mystermeat action=eaten
| stats count as corndog_count by user
A. Creates a table of the total count of users and split by corndogs.
B. Creates a table of the total count of mysterymeat corndogs split by user.
C. Creates a table with the count of all types of corndogs eaten split by user.
D. Creates a table that groups the total number of users by vegetarian corndogs. correct answers
ANSWER: B
, What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
A. Custom visualizations
B. Pre-configured data models
C. Fields and event category tags
D. Automatic data model acceleration correct answers ANSWER: B C
The Field Extractor (FX) is used to extract a custom field. A report can be created using this
custom field. The created report can then be shared with other people in the organization. If
another person in the organization runs the shared report and no results are returned, why might
this be? (select all that apply)
A. Fast mode is enabled.
B. The dashboard is private.
C. The extraction is private-
D. The person in the organization running the report does not have access to the index. correct
answers ANSWER: CD
Selected fields are displayed ______each event in the search results.
A. below
B. interesting fields
C. other fields
D. above correct answers ANSWER:A
How does a user display a chart in stack mode?
A. By using the stack command.
B. By turning on the Use Trellis Layout option.
C. By changing Stack Mode in the Format menu.
D. You cannot display a chart in stack mode, only a timechart. correct answers ANSWER: C
Which of the following is the correct way to use the data model command to search field in the
data model
within the web dataset?
A. | datamodel web search | filed web *
B. | Search datamodel web web | filed web*
C. | datamodel web web field | search web*
D. Datamodel=web | search web | filed web* correct answers ANSWER: A
Which of the following statements describes macros?
A. A macro is a reusable search string that must contain the full search.
B. A macro is a reusable search string that must have a fixed time range.
Pass.
When performing a regular expression (regex) field extraction using the Field Extractor (FX),
what happens
when the require option is used?
A. The regex can no longer be edited.
B. The field being extracted will be required for all future events.
C. The events without the required field will not display in searches.
D. Only events with the required string will be included in the extraction. correct answers
ANSWER: D
Which of the following statements describe data model acceleration? (select all that apply)
A.Root events cannot be accelerated.
B.Accelerated data models cannot be edited.
C.Private data models cannot be accelerated.
D.You must have administrative permissions or the accelerate_dacamodel capability to
accelerate a data model. correct answers ANSWER: BCD
Which of the following are required to create a POST workflow action?
A. Label, URI, search string.
B. XMI attributes, URI, name.
C. Label, URI, post arguments.
D. URI, search string, time range picker. correct answers ANSWER: B
In which of the following scenarios is an event type more effective than a saved search?
A. When a search should always include the same time range.
B. When a search needs to be added to other users' dashboards.
C. When the search string needs to be used in future searches.
D. When formatting needs to be included with the search string. correct answers ANSWER: D
What does the following search do?
index=corndog type=mystermeat action=eaten
| stats count as corndog_count by user
A. Creates a table of the total count of users and split by corndogs.
B. Creates a table of the total count of mysterymeat corndogs split by user.
C. Creates a table with the count of all types of corndogs eaten split by user.
D. Creates a table that groups the total number of users by vegetarian corndogs. correct answers
ANSWER: B
, What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
A. Custom visualizations
B. Pre-configured data models
C. Fields and event category tags
D. Automatic data model acceleration correct answers ANSWER: B C
The Field Extractor (FX) is used to extract a custom field. A report can be created using this
custom field. The created report can then be shared with other people in the organization. If
another person in the organization runs the shared report and no results are returned, why might
this be? (select all that apply)
A. Fast mode is enabled.
B. The dashboard is private.
C. The extraction is private-
D. The person in the organization running the report does not have access to the index. correct
answers ANSWER: CD
Selected fields are displayed ______each event in the search results.
A. below
B. interesting fields
C. other fields
D. above correct answers ANSWER:A
How does a user display a chart in stack mode?
A. By using the stack command.
B. By turning on the Use Trellis Layout option.
C. By changing Stack Mode in the Format menu.
D. You cannot display a chart in stack mode, only a timechart. correct answers ANSWER: C
Which of the following is the correct way to use the data model command to search field in the
data model
within the web dataset?
A. | datamodel web search | filed web *
B. | Search datamodel web web | filed web*
C. | datamodel web web field | search web*
D. Datamodel=web | search web | filed web* correct answers ANSWER: A
Which of the following statements describes macros?
A. A macro is a reusable search string that must contain the full search.
B. A macro is a reusable search string that must have a fixed time range.
