SPLK-1002 Splunk Core Certified Power User Questions
With Complete Solutions
A data model consists of which three types of datasets?
A. Constraint, field, value.
B. Events, searches, transactions.
C. Field extraction, regex, delimited.
D. Transaction, session ID, metadata. Correct Answers B.
Events, searches, transactions.
A field alias has been created based on an original field. A
search without any transforming commands is then executed in
Smart Mode.
Which field name appears in the results?
A. Both will appear in the All Fields list, but only if the alias is
specified in the search.
B. Both will appear in the Interesting Fields list, but only if they
appear in at least 20 percent of events.
C. The original field only appears in All Fields list and the alias
only appears in the Interesting Fields list.
D. The alias only appears in the All Fields list and the original
field only appears in the Interesting Fields list. Correct Answers
B. Both will appear in the Interesting Fields list, but only if they
appear in at least 20 percent of events.
A user wants to convert numeric field values to strings and also
to sort on those values.
Which command should be used first, the eval or the sort?
,A. It doesn't matter whether eval or sort is used first.
B. Convert the numeric to a string with eval first, then sort.
C. Use sort first, then convert the numeric to a string with eval.
D. You cannot use the sort command and the eval command on
the same field. Correct Answers C. Use sort first, then convert
the numeric to a string with eval.
After manually editing a regular expression (regex), which of
the following statements is true?
A. Changes made manually can be reverted in the Field
Extractor (FX) UI.
B. It is no longer possible to edit the field extraction in the Field
Extractor (FX) UI.
C. It is not possible to manually edit a regular expression (regex)
that was created using the Field Extractor (FX) UI.
D. The Field Extractor (FX) UI keeps its own version of the
field extraction in addition to the one that was manually edited.
Correct Answers B. It is no longer possible to edit the field
extraction in the Field Extractor (FX) UI.
Based on the macro definition shown below, what is the correct
way to execute the macro in a search string?
A. "convert_sales(euro,€,.79)"
B. 'convert_sales(euro,€,.79)'
C. "convert_sales($euro$,$€$,$.79$)"
D. 'convert_sales($euro$,$€$,$.79$)' Correct Answers B.
'convert_sales(euro,€,.79)'
, By default, how is acceleration configured in the Splunk
Common Information Model (CIM) add-on?
A. Turned off.
B. Turned on.
C. Determined automatically based on the sourcetype.
D. Determined automatically based on the data source. Correct
Answers A. Turned off.
Calculated fields can be based on which of the following?
A. Tags
B. Extracted fields
C. Output fields for a lookup
D. Fields generated from a search string Correct Answers B.
Extracted fields
Data models are composed of one or more of which of the
following datasets? (Choose all that apply.)
A. Events datasets
B. Search datasets
C. Transaction datasets
D. Any child of event, transaction, and search datasets Correct
Answers A. Events datasets
B. Search datasets
C. Transaction datasets
Given the macro definition below, what should be entered into
the Name and Arguments fields to correctly configure the
macro?
With Complete Solutions
A data model consists of which three types of datasets?
A. Constraint, field, value.
B. Events, searches, transactions.
C. Field extraction, regex, delimited.
D. Transaction, session ID, metadata. Correct Answers B.
Events, searches, transactions.
A field alias has been created based on an original field. A
search without any transforming commands is then executed in
Smart Mode.
Which field name appears in the results?
A. Both will appear in the All Fields list, but only if the alias is
specified in the search.
B. Both will appear in the Interesting Fields list, but only if they
appear in at least 20 percent of events.
C. The original field only appears in All Fields list and the alias
only appears in the Interesting Fields list.
D. The alias only appears in the All Fields list and the original
field only appears in the Interesting Fields list. Correct Answers
B. Both will appear in the Interesting Fields list, but only if they
appear in at least 20 percent of events.
A user wants to convert numeric field values to strings and also
to sort on those values.
Which command should be used first, the eval or the sort?
,A. It doesn't matter whether eval or sort is used first.
B. Convert the numeric to a string with eval first, then sort.
C. Use sort first, then convert the numeric to a string with eval.
D. You cannot use the sort command and the eval command on
the same field. Correct Answers C. Use sort first, then convert
the numeric to a string with eval.
After manually editing a regular expression (regex), which of
the following statements is true?
A. Changes made manually can be reverted in the Field
Extractor (FX) UI.
B. It is no longer possible to edit the field extraction in the Field
Extractor (FX) UI.
C. It is not possible to manually edit a regular expression (regex)
that was created using the Field Extractor (FX) UI.
D. The Field Extractor (FX) UI keeps its own version of the
field extraction in addition to the one that was manually edited.
Correct Answers B. It is no longer possible to edit the field
extraction in the Field Extractor (FX) UI.
Based on the macro definition shown below, what is the correct
way to execute the macro in a search string?
A. "convert_sales(euro,€,.79)"
B. 'convert_sales(euro,€,.79)'
C. "convert_sales($euro$,$€$,$.79$)"
D. 'convert_sales($euro$,$€$,$.79$)' Correct Answers B.
'convert_sales(euro,€,.79)'
, By default, how is acceleration configured in the Splunk
Common Information Model (CIM) add-on?
A. Turned off.
B. Turned on.
C. Determined automatically based on the sourcetype.
D. Determined automatically based on the data source. Correct
Answers A. Turned off.
Calculated fields can be based on which of the following?
A. Tags
B. Extracted fields
C. Output fields for a lookup
D. Fields generated from a search string Correct Answers B.
Extracted fields
Data models are composed of one or more of which of the
following datasets? (Choose all that apply.)
A. Events datasets
B. Search datasets
C. Transaction datasets
D. Any child of event, transaction, and search datasets Correct
Answers A. Events datasets
B. Search datasets
C. Transaction datasets
Given the macro definition below, what should be entered into
the Name and Arguments fields to correctly configure the
macro?
