Splunk Core Power Exam 1 Questions With Complete Solutions A+ Pass

Splunk Core Power Exam 1 Questions With Complete Solutions A+ Pass Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID A. An additional filed named maxspan is created. B. An additional Held named duration is created. C. An additional field named eventcount is created. D. Events with the same JSESSIONID will be grouped together into a single event. - Answer- B. An additional Held named duration is created. C. An additional field named eventcount is created. D. Events with the same JSESSIONID will be grouped together into a single event. By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on? A. Turned off B. Turned on C. Determined automatically based on the sourcetype. D. Determined automatically based on the data source. - Answer- D. Determined automatically based on the data source. The stats command will create a _____________ by default. A. Table B. Report C. Pie chart - Answer- A. Table When using a field value variable with a Workflow Action, which punctuation mark will escape the data A. * B. ! C. ^ D. # - Answer- B. ! A real-time alert is ______________. A. A scheduled alert B. constantly running in the background - Answer- B. constantly running in the background What is the correct syntax to search for a tag associated with a value on a specific fields? A. Tag-field? B. Tagfiled(tagname.) C. Tag=filed::tagname D. Tag::filed=tagname - Answer- Tag::filed=tagname Field aliases are used to __________ data A. clean B. transform C. calculate D. normalize - Answer- D. normalize Which statement is true? A. Pivot is used for creating datasets. B. Data model are randomly structured datasets. C. Pivot is used for creating reports and dashboards. D. In most cases, each Splunk user will create their own data model. - Answer- C. Pivot is used for creating reports and dashboards. Which of the following statements describes POST workflow actions? A. Configuration of a POST workflow action includes choosing a sourcetype. B. POST workflow actions can be configured to send email to the URI location. C. By default, POST workflow action are shown in both the event and field menus. D. POST workflow actions can be configured to send POST arguments to the URI location. - Answer- A. Configuration of a POST workflow action includes choosing a sourcetype. What does the Splunk Common Information Model (CIM) add-on include? (select all that apply) A. Custom visualizations B. Pre-configured data models C. Fields and event category tags D. Automatic data model acceleration - Answer- A. Custom visualizations C. Fields and event category tags which of the following commands are used when creating visualizations(select all that apply.) A. Geom B. Choropleth C. Geostats D. iplocation - Answer- A. Geom C. Geostats D. iplocation What is the relationship between data models and pivots? A. Data models provide the datasets for pivots. B. Pivots and data models have no relationship. C. Pivots and data models are the same thing. D. Pivots provide the datasets for data models. - Answer- D. Pivots provide the datasets for data models Which of these is NOT a field that is automatically created with the transaction command? A. maxcount B. duration C. eventcount - Answer- A. maxcount When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used? A. The regex can no longer be edited. B. The field being extracted will be required for all future events. C. The events without the required field will not display in searches. D. Only events with the required string will be included in the extraction. - Answer- D. Only events with the required string will be included in the extraction. The fields sidebar does not show________. (Select all that apply.) A. interesting fields B. selected fields C. all extracted fields - Answer- C. all extracted fields This clause is used to group the output of a stats command by a specific name. A. Rex B. As C. List D. By - Answer- B. As Which of these search strings is NOT valid: A. index=web status=50* | chart count over host, status B. index=web status=50* | chart count over host by status C. index=web status=5-* | chart count by host, status - Answer- B. index=web status=50* | chart count over host by status What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration) A. The average time elapsed during each transaction for all transactions B. The average time for each event within each transaction C. The average time between each transaction - Answer- A. The average time elapsed during each transaction for all transactions It is mandatory for the lookup file to have this for an automatic lookup to work. A. Source type B. At least five columns C. Timestamp D. Input filed - Answer- D. Input filed To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct? A. Index-main | REJECT trans sessionid B. Index-main | transaction sessionid | search REJECT C. Index=main | transaction sessionid | whose transaction=reject D. Index=main | transaction sessionid | where transaction=reject'' - Answer- D. Index=main | transaction sessionid | where transaction=reject'' Which search would limit an "alert" tag to the "host" field? A. tag=alert B. host::tag::alert C. tag==alert D. tag::host=alert - Answer- D. tag::host=alert When using | timchart by host, which filed is representted in the x-axis? A. date B. host C. time D. -time - Answer- A. date The transaction command allows you to __________ events across multiple sources A. duplicate B. correlate C. persist D. tag - Answer- B. correlate Calculated fields can be based on which of the following? A. Tags B. Extracted fields C. Output fields for a lookup D. Fields generated from a search string - Answer- B. Extracted fields What other syntax will produce exactly the same results as | chart count over vendor_action by user? A. | chart count by vendor_action, user B. | chart count over vendor_action, user C. | chart count by vendor_action over user D. | chart count over user by vendor_ - Answer- C. | chart count by vendor_action over user Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s A. Events in the transaction occurred within 5 seconds. B. It groups events that share the same clientip and host. C. The first and last events are no more than 5 seconds apart. D. The first and last events are no more than 30 seconds apart. - Answer- B. It groups events that share the same clientip and host. Use the dedup command to _____. A. Rename a field in the index B. remove duplicate values C. provide an additional alias for the field that can D.be used in the search criteria - Answer- B. remove duplicate values In the Field Extractor Utility, this button will display events that do not contain extracted fields. Select your answer. A. Selected-Fields B. Non-Matches C. Non-Extractions D. Matches - Answer- B. Non-Matches These users can create global knowledge objects. (Select all that apply.) A. users B. power users C. administrators - Answer- B. power users C. administrators Which of the following describes the Splunk Common Information Model (CIM) add-on? A. The CIM add-on uses machine learning to normalize data. B. The CIM add-on contains dashboards that show how to map data. C. The CIM add-on contains data models to help you normalize data. D. The CIM add-on is automatically installed in a Splunk environment. - Answer- C. The CIM add-on contains data models to help you normalize data. Which of the following about reports is/are true? A. Reports are knowledge objects. B. Reports can be scheduled. C. Reports can run a script. D. All of the above. - Answer- D. All of the above. A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results? A. Both will appear in the All Fields list, but only if the alias is specified in the search. B. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events. C. The original field only appears in All Fields list and the alias only appears in the Interesting Fields list. D. The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list. - Answer- B. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events. Where are the results of eval commands stored? A. In a field. B. In an index. C. In a KV Store. D. In a database. - Answer- A. In a field. Explanation: Which of the following searches would create a graph similar to the one below? A. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states B. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time C. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status D. None of these searches would generate a similart graph. - Answer- A. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states