Splunk Core Power User Exam Questions With Complete
Solutions
_____ datasets can be added to a root dataset to narrow down
the search.
a. event
b. child
c. parent
d. extracted Correct Answers b. child
A report scheduled to run every 15 mins, but it takes 17 mins to
complete in danger of being
a. skipped or deferred
b. automatically accelerated
c. deleted
d. all the above Correct Answers a. skipped or deferred
A space is implied ______________ in a search string.
a. OR
b. AND
c. ()
d. NOT Correct Answers b. AND
After you create a pivot, you can save it as a _________ (select
all the apply)
a. tag
b. eventtype
,c. report
d. dashboard panel Correct Answers c. report
d. dashboard panel
Alert throtting is used to ________
a. verify each alert
b. stagger search request in a time sequenced order
c. stop spamming yourself with alerts
d. check severity Correct Answers c. stop spamming yourself
with alerts
By default, data models in the CIM Add-on will search across
all indexes.
FALSE
TRUE Correct Answers True
Calculated fields are based on underlying:
a. eval expressions
b. keyword searches
c. stats commands Correct Answers a. eval expressions
Calculated fields can be based on which of the following?
A. Tags
B. Extracted fields
C. Output fields for a lookup
D. Fields generated from a search string Correct Answers B.
Extracted fields
Clicking on a SEGMENT on a chart __________.
, a. drills down for that data
b. highlights the field value across the chart
c. add the highlighed value to the search criteria Correct
Answers c. add the highlighed value to the search criteria
Custom charts can be created in the fields sidebar (T/F) Correct
Answers False
Default fields are not added to every event in Splunk at INDEX
time.
(T/F) Correct Answers False
During the validation step of the Field Extractor workflow:
You cannot modify the field extraction
You can validate where the data originated from
You can remove values that aren't a match for the field you want
to define Correct Answers
Field aliases are used to _____ data.
a. transform
b. clean
c. calculate
d. normalize Correct Answers d. normalize
Field aliases can only be applied to a single source type, source,
or host.
FALSE
Solutions
_____ datasets can be added to a root dataset to narrow down
the search.
a. event
b. child
c. parent
d. extracted Correct Answers b. child
A report scheduled to run every 15 mins, but it takes 17 mins to
complete in danger of being
a. skipped or deferred
b. automatically accelerated
c. deleted
d. all the above Correct Answers a. skipped or deferred
A space is implied ______________ in a search string.
a. OR
b. AND
c. ()
d. NOT Correct Answers b. AND
After you create a pivot, you can save it as a _________ (select
all the apply)
a. tag
b. eventtype
,c. report
d. dashboard panel Correct Answers c. report
d. dashboard panel
Alert throtting is used to ________
a. verify each alert
b. stagger search request in a time sequenced order
c. stop spamming yourself with alerts
d. check severity Correct Answers c. stop spamming yourself
with alerts
By default, data models in the CIM Add-on will search across
all indexes.
FALSE
TRUE Correct Answers True
Calculated fields are based on underlying:
a. eval expressions
b. keyword searches
c. stats commands Correct Answers a. eval expressions
Calculated fields can be based on which of the following?
A. Tags
B. Extracted fields
C. Output fields for a lookup
D. Fields generated from a search string Correct Answers B.
Extracted fields
Clicking on a SEGMENT on a chart __________.
, a. drills down for that data
b. highlights the field value across the chart
c. add the highlighed value to the search criteria Correct
Answers c. add the highlighed value to the search criteria
Custom charts can be created in the fields sidebar (T/F) Correct
Answers False
Default fields are not added to every event in Splunk at INDEX
time.
(T/F) Correct Answers False
During the validation step of the Field Extractor workflow:
You cannot modify the field extraction
You can validate where the data originated from
You can remove values that aren't a match for the field you want
to define Correct Answers
Field aliases are used to _____ data.
a. transform
b. clean
c. calculate
d. normalize Correct Answers d. normalize
Field aliases can only be applied to a single source type, source,
or host.
FALSE
