Splunk Core Power Exam 1 || Questions and 100% Verified Answers.
Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID A. An additional filed named maxspan is created. B. An additional Held named duration is created. C. An additional field named eventcount is created. D. Events with the same JSESSIONID will be grouped together into a single event. correct answers B. An additional Held named duration is created. C. An additional field named eventcount is created. D. Events with the same JSESSIONID will be grouped together into a single event.
By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on? A. Turned off B. Turned on C. Determined automatically based on the sourcetype. D. Determined automatically based on the data source. correct answers D. Determined automatically based on the data source.
The stats command will create a _____________ by default. A. Table B. Report C. Pie chart correct answers A. Table
When using a field value variable with a Workflow Action, which punctuation mark will escape the data A. * B. ! C. ^ D. # correct answers B. !
A real-time alert is ______________. A. A scheduled alert B. constantly running in the background correct answers B. constantly running in the background
What is the correct syntax to search for a tag associated with a value on a specific fields? A. Tag-<field?
B. Tag<filed(tagname.)
C. Tag=<filed>::<tagname> D. Tag::<filed>=<tagname> correct answers Tag::<filed>=<tagname>
Field aliases are used to __________ data A. clean B. transform C. calculate D. normalize correct answers D. normalize
Which statement is true? A. Pivot is used for creating datasets. B. Data model are randomly structured datasets. C. Pivot is used for creating reports and dashboards. D. In most cases, each Splunk user will create their own data model. correct answers C. Pivot is used for creating reports and dashboards.
Which of the following statements describes POST workflow actions? A. Configuration of a POST workflow action includes choosing a sourcetype. B. POST workflow actions can be configured to send email to the URI location. C. By default, POST workflow action are shown in both the event and field menus. D. POST workflow actions can be configured to send POST arguments to the URI location. correct answers A. Configuration of a POST workflow action includes choosing a sourcetype.
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
A. Custom visualizations B. Pre-configured data models C. Fields and event category tags D. Automatic data model acceleration correct answers A. Custom visualizations
C. Fields and event category tags
which of the following commands are used when creating visualizations(select all that apply.) A.
Geom B. Choropleth C. Geostats D. iplocation correct answers A. Geom C. Geostats D. iplocation
What is the relationship between data models and pivots? A. Data models provide the datasets for pivots. B. Pivots and data models have no relationship. C. Pivots and data models are the same thing. D. Pivots provide the datasets for data models. correct answers D. Pivots provide the datasets for data models
Which of these is NOT a field that is automatically created with the transaction command? A. maxcount B. duration C. eventcount correct answers A. maxcount
When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used? A. The regex can no longer be edited. B. The field being extracted will be required for all future events. C. The events without the required field will not display in searches. D. Only events with the required string will be included in the extraction. correct answers D. Only events with the required string will be included in the extraction.
The fields sidebar does not show________. (Select all that apply.) A. interesting fields B. selected fields C. all extracted fields correct answers C. all extracted fields This clause is used to group the output of a stats command by a specific name. A. Rex B. As C. List D. By correct answers B. As
Which of these search strings is NOT valid:
A. index=web status=50* | chart count over host, status B. index=web status=50* | chart count over host by status C. index=web status=5-* | chart count by host, status correct answers B. index=web status=50* | chart count over host by status
What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration) A. The average time elapsed during each transaction for all transactions B. The average time for each event within each transaction C. The average time between each transaction correct answers A. The average time elapsed during each transaction for all transactions
It is mandatory for the lookup file to have this for an automatic lookup to work. A. Source type B. At least five columns C. Timestamp D. Input filed correct answers D. Input filed
To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct? A. Index-main | REJECT trans sessionid B. Index-main | transaction sessionid | search REJECT C. Index=main | transaction sessionid | whose transaction=reject D. Index=main | transaction sessionid | where transaction=reject'' correct answers D. Index=main | transaction sessionid | where transaction=reject''
Which search would limit an "alert" tag to the "host" field? A. tag=alert B. host::tag::alert C. tag==alert D. tag::host=alert correct answers D. tag::host=alert
When using | timchart by host, which filed is representted in the x-axis? A. date B. host C. time D. -time correct answers A. date
The transaction command allows you to __________ events across multiple sources A. duplicate
B. correlate C. persist D. tag correct answers B. correlate
Calculated fields can be based on which of the following? A. Tags B. Extracted fields C. Output fields for a lookup D. Fields generated from a search string correct answers B. Extracted fields
What other syntax will produce exactly the same results as | chart count over vendor_action by user? A. | chart count by vendor_action, user B. | chart count over vendor_action, user C. | chart count by vendor_action over user D. | chart count over user by vendor_ correct answers C. | chart
count by vendor_action over user
Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s A. Events in the transaction occurred within 5 seconds. B. It groups events that share the same clientip and host. C. The first and last events are no more than 5 seconds apart. D. The first and last events are no more than 30 seconds
apart. correct answers B. It groups events that share the same clientip and host.
Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID A. An additional filed named maxspan is created. B. An additional Held named duration is created. C. An additional field named eventcount is created. D. Events with the same JSESSIONID will be grouped together into a single event. correct answers B. An additional Held named duration is created. C. An additional field named eventcount is created. D. Events with the same JSESSIONID will be grouped together into a single event.
By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on? A. Turned off B. Turned on C. Determined automatically based on the sourcetype. D. Determined automatically based on the data source. correct answers D. Determined automatically based on the data source.
The stats command will create a _____________ by default. A. Table B. Report C. Pie chart correct answers A. Table
When using a field value variable with a Workflow Action, which punctuation mark will escape the data A. * B. ! C. ^ D. # correct answers B. !
A real-time alert is ______________. A. A scheduled alert B. constantly running in the background correct answers B. constantly running in the background
What is the correct syntax to search for a tag associated with a value on a specific fields? A. Tag-<field?
B. Tag<filed(tagname.)
C. Tag=<filed>::<tagname> D. Tag::<filed>=<tagname> correct answers Tag::<filed>=<tagname>
Field aliases are used to __________ data A. clean B. transform C. calculate D. normalize correct answers D. normalize
Which statement is true? A. Pivot is used for creating datasets. B. Data model are randomly structured datasets. C. Pivot is used for creating reports and dashboards. D. In most cases, each Splunk user will create their own data model. correct answers C. Pivot is used for creating reports and dashboards.
Which of the following statements describes POST workflow actions? A. Configuration of a POST workflow action includes choosing a sourcetype. B. POST workflow actions can be configured to send email to the URI location. C. By default, POST workflow action are shown in both the event and field menus. D. POST workflow actions can be configured to send POST arguments to the URI location. correct answers A. Configuration of a POST workflow action includes choosing a sourcetype.
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
A. Custom visualizations B. Pre-configured data models C. Fields and event category tags D. Automatic data model acceleration correct answers A. Custom visualizations
C. Fields and event category tags
which of the following commands are used when creating visualizations(select all that apply.) A.
Geom B. Choropleth C. Geostats D. iplocation correct answers A. Geom C. Geostats D. iplocation
What is the relationship between data models and pivots? A. Data models provide the datasets for pivots. B. Pivots and data models have no relationship. C. Pivots and data models are the same thing. D. Pivots provide the datasets for data models. correct answers D. Pivots provide the datasets for data models
Which of these is NOT a field that is automatically created with the transaction command? A. maxcount B. duration C. eventcount correct answers A. maxcount
When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used? A. The regex can no longer be edited. B. The field being extracted will be required for all future events. C. The events without the required field will not display in searches. D. Only events with the required string will be included in the extraction. correct answers D. Only events with the required string will be included in the extraction.
The fields sidebar does not show________. (Select all that apply.) A. interesting fields B. selected fields C. all extracted fields correct answers C. all extracted fields This clause is used to group the output of a stats command by a specific name. A. Rex B. As C. List D. By correct answers B. As
Which of these search strings is NOT valid:
A. index=web status=50* | chart count over host, status B. index=web status=50* | chart count over host by status C. index=web status=5-* | chart count by host, status correct answers B. index=web status=50* | chart count over host by status
What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration) A. The average time elapsed during each transaction for all transactions B. The average time for each event within each transaction C. The average time between each transaction correct answers A. The average time elapsed during each transaction for all transactions
It is mandatory for the lookup file to have this for an automatic lookup to work. A. Source type B. At least five columns C. Timestamp D. Input filed correct answers D. Input filed
To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct? A. Index-main | REJECT trans sessionid B. Index-main | transaction sessionid | search REJECT C. Index=main | transaction sessionid | whose transaction=reject D. Index=main | transaction sessionid | where transaction=reject'' correct answers D. Index=main | transaction sessionid | where transaction=reject''
Which search would limit an "alert" tag to the "host" field? A. tag=alert B. host::tag::alert C. tag==alert D. tag::host=alert correct answers D. tag::host=alert
When using | timchart by host, which filed is representted in the x-axis? A. date B. host C. time D. -time correct answers A. date
The transaction command allows you to __________ events across multiple sources A. duplicate
B. correlate C. persist D. tag correct answers B. correlate
Calculated fields can be based on which of the following? A. Tags B. Extracted fields C. Output fields for a lookup D. Fields generated from a search string correct answers B. Extracted fields
What other syntax will produce exactly the same results as | chart count over vendor_action by user? A. | chart count by vendor_action, user B. | chart count over vendor_action, user C. | chart count by vendor_action over user D. | chart count over user by vendor_ correct answers C. | chart
count by vendor_action over user
Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s A. Events in the transaction occurred within 5 seconds. B. It groups events that share the same clientip and host. C. The first and last events are no more than 5 seconds apart. D. The first and last events are no more than 30 seconds
apart. correct answers B. It groups events that share the same clientip and host.
