Try SPLK-1002 Exam Valid Dumps with Instant Download Free Updates [Q83-Q102]

QUESTION 83
Which group of users would most likely use pivots?

Users

Architects

Administrators

Knowledge Managers

QUESTION 84
Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID

An additional filed named maxspan is created.

An additional Held named duration is created.

An additional field named eventcount is created.

Events with the same JSESSIONID will be grouped together into a single event.

QUESTION 85
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Custom visualizations

Pre-configured data models

Fields and event category tags

Automatic data model acceleration

QUESTION 86
When using timechart, how many fields can be listed after a byclause?

0, because timechart doesn’t support using a by clause.

1, because _time is already implied as the x-axis.

2, because one field would represent the x-axis and the other would represent the y-axis.

There is no limit specific to timechart.

QUESTION 87
There are several ways to access the field extractor.
Which option automatically identifies the data type, source type, and sample event?

Event Actions > Extract Fields

Fields sidebar > Extract New Fields

Settings > Field Extractions > New Field Extraction

Settings > Field Extractions > Open Field Extractor

QUESTION 88
Which type of visualization shows relationships between discrete values in three dimensions?

Pie chart

Line chart

Bubble chart

Scatter chart

QUESTION 89
After manually editing; a regular expression (regex), which of the following statements is true?

Changes made manually can be reverted in the Field Extractor (FX) UI.

It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.

The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

QUESTION 90
How does a user display a chart in stack mode?

By using the stackcommand.

By turning on the Use Trellis Layout option.

By changing Stack Mode in the Format menu.

You cannot display a chart in stack mode, only a timechart.

QUESTION 91
Which of the following can be used with the evalcommand tostringfunction? (Choose all that apply.)

“hex”

“commas”

“decimal”

“duration”

QUESTION 92
Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

The macro name is sessiontracker and the arguments are action, JESSIONID.

The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

QUESTION 93
Which of the following searches show a valid use of macro? (Select all that apply)

index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField

index=main source=mySource oldField=* | stats if(‘makeMyField(oldField)’) | table _time newField

index=main source=mySource oldField=* | eval newField=’makeMyField(oldField)’| table _time newField

index=main source=mySource oldField=* | “‘newField(‘makeMyField(oldField)’)'” | table _time newField

QUESTION 94
Which search mode returns all fields?

Verbose mode

Fast mode

Smart mode

QUESTION 95
What is the Splunk Common Information Model (CIM)?

The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.

The CIM provides a methodology to normalize data from different sources and source types.

The CIM defines an ecosystem of apps that can be fully supported by Splunk.

The CIM is a data exchange initiative between software vendors.

QUESTION 96
Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Events in the transaction occurred within 5 seconds.

It groups events that share the same clientip and host.

The first and last events are no more than 5 seconds apart.

The first and last events are no more than 30 seconds apart.

QUESTION 97
When using | timechart by host, which field is represented in the x-axis?

date

host

time

_time

QUESTION 98
Which of the following statements is true, especially in largo environments?

Use the scats command when you next to group events by two or more fields.

The stats command is faster and more efficient than the transaction command

The transaction command is faster and more efficient than the stats command.

Use the transaction command when you want to see the results of a calculation.

QUESTION 99
What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

There is a limit to the number of fields that can be extracted.

The user is unable to preview the extractions.

The extraction is added at index time.

The user is unable to return to the automatic field extraction workflow.

QUESTION 100
Which one of the following statements about the search command is true?

It does not allow the use of wildcards.

It treats field values in a case-sensitive manner.

It can only be used at the beginning of the search pipeline.

It behaves exactly like search strings before the first pipe.

QUESTION 101
The timechart command buckets data in time intervals depending on:

the number of events returned

the selected time range

the type of visualization selected

QUESTION 102
When using the transaction command, what does the argument maxspan do?

Sets the maximum total time between events in a transaction.

Sets the maximum length of all events within a transaction.

Sets the maximum total time between the earliest and latest events in a transaction.

Sets the maximum length that any single event can reach to be included in the transaction.

Try SPLK-1002 Exam Valid Dumps with Instant Download Free Updates [Q83-Q102]

Be the first to reply

Leave a Reply Cancel reply