[UPDATED] Splunk SPLK-1002 Certification Exam Questions
Quickly and Easily Pass Splunk Exam with SPLK-1002 real Dumps
splk-1002 Exam topics
Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our splk-1002 exam dumps will include the following topics:
1. Splunk Fundamentals
Select a data model object
Describe alerts
Create reports that include visualizations such as charts
What is the Common Information Model (CIM)?
Identify the contents of search results
Examine the search pipeline
Customizing your user settings
Create an instant pivot from a search
Save a search as a report
Work with events
Module 5 - Using Fields in Searches
Module 1 - Introduction
Module 4 - Basic Searching
View fired alerts
Control a search job
Define Splunk Apps
Refine searches
Module 6 - Search Language Fundamentals
Module 7 - Using Basic Transforming Commands
Use fields in searches
Create a dashboard
Module 2 - What is Splunk?
Understand the uses of Splunk
Create a pivot report
Module 11 - Creating Scheduled Reports and Alerts
Module 8 - Creating Reports and Dashboards
and tables
Use autocomplete and syntax highlighting
Edit a dashboard
Describe Pivot
Understand the relationship between data models and pivot
Configure an automatic lookup
Installing Splunk
Getting data into Splunk
Module 12 - Using Pivot
Understand fields
Naming conventions
Learn basic navigation in Splunk
Create alerts
The stats command
Module 3 - Introduction to Splunk's User Interface
What are datasets?
Module 9 - Datasets and the Common Information Model
2. Splunk Fundamentals
Describe, create and use calculated fields
The geostats command
The addtotals command
Overview of Buttercup Games Inc.
Module 10 - Creating Tags and Event Types
Describe the Splunk CIM
Create a data model
Module 2 - Beyond Search Fundamentals
Create and use tags
Using the job inspector to view search performance
Group events using fields
The eval command
Group events using fields and time
Lab environment
Using the search and where commands to filter results
Describe the relationship between data models and pivot
Manage knowledge objects
Add and use arguments with a macro
Create a POST workflow action
Create a GET workflow action
Module 1 - Introduction
Review permissions
Add-On
The filnull command
Create and format charts and timecharts
Explore data structure requirements
Perform regex field extractions using the Field Extractor (FX)
Describe macros
Identify transactions
Define arguments and variables for a macro
Create a Search workflow action
Create an event type
Module 14 - Using the Common Information Model (CIM) Add-On
Perform delimiter field extractions using the FX
List the knowledge objects included with the Splunk CIM
Module 4 - Using Mapping and Single Value Commands
The geom command
Describe event types and their uses
The iplocation command
Module 3 - Using Transforming Commands for Visualizations
Module 5 - Filtering and Formatting Results
Case sensitivity
Search with transactions
Explore visualization types
Module 7 - Introduction to Knowledge Objects
Module 11 - Creating and Using Macros
Determine when to use transactions vs. stats
Module 8 - Creating and Managing Fields
Report on transactions
NEW QUESTION # 104
Which of the following statements would help a user choose between the transaction and stats commands?
- A. There is a 1000 event limitation with the transaction command.
- B. state can only group events using IP addresses.
- C. Use state when the events need to be viewed as a single event.
- D. The transaction command is faster and more efficient.
Answer: A
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transaction
NEW QUESTION # 105
In what order arc the following knowledge objects/configurations applied?
- A. Lookups, Field Aliases, Field Extractions
- B. Field Extractions, Lookups, Field Aliases
- C. Field Extractions, Field Aliases, Lookups
- D. Field Aliases, Field Extractions, Lookups
Answer: C
Explanation:
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/WhatisSplunkknowledge
NEW QUESTION # 106
When using the timechart command, how can a user group the events into buckets based on time?
- A. Using the span argument.
- B. Using the duration argument.
- C. Using the interval argument.
- D. Adjusting the fieldformat options.
Answer: A
NEW QUESTION # 107
Which of the following statements describes the use of the Filed Extractor (FX)?
- A. The Field Extractor uses PERL to extract field from the raw events.
- B. Field extracted using the Extracted persist as knowledge objects.
- C. Fields extracted using the Field Extractor do not persist and must be defined for each search.
- D. The Field Extractor automatically extracts all field at search time.
Answer: C
NEW QUESTION # 108
Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)
- A. Auto-Extracted fields can be given a friendly name for use in Pivot.
- B. Auto-Extracted fields can be hidden in Pivot.
- C. Auto-Extracted fields can have their data type changed.
- D. Auto-Extracted fields can be added if they already exist in the dataset with constraints.
Answer: C
NEW QUESTION # 109
Which of the following statements describes macros?
- A. A macro Is a reusable search string that must contain only a portion of the search.
- B. A macro is a reusable search string that must have a fixed time range.
- C. A macro Is a reusable search string that may have a flexible time range.
- D. A macro is a reusable search string that must contain the full search.
Answer: C
NEW QUESTION # 110
Which of these search strings is NOT valid:
- A. index=web status=50* | chart count over host by status
- B. index=web status=50* | chart count by host, status
- C. index=web status=50* | chart count over host, status
Answer: C
NEW QUESTION # 111
The fields sidebar does not show________. (Select all that apply.)
- A. all extracted fields
- B. interesting fields
- C. selected fields
Answer: A
NEW QUESTION # 112
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)
- A. Spaces
- B. Colons
- C. Pipes
- D. Tabs
Answer: A,C,D
Explanation:
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep
NEW QUESTION # 113
Which of the following statements is true, especially in large environments?
- A. Use the scats command when you next to group events by two or more fields.
- B. Use the transaction command when you want to see the results of a calculation.
- C. The stats command is faster and more efficient than the transaction command
- D. The transaction command is faster and more efficient than the stats command.
Answer: C
Explanation:
Reference:
https://answers.splunk.com/answers/103/transaction-vs-stats-commands.html
NEW QUESTION # 114
Which of the following statements describes field aliases?
- A. Field alias names replace the original field name.
- B. Field aliases can be used in lookup file definitions.
- C. Field aliases only normalize data across sources and sourcetypes.
- D. Field alias names are not case sensitive when used as part of a search.
Answer: B
NEW QUESTION # 115
What does the fillnull command replace null values with, it the value argument is not specified?
- A. NaN
- B. 0
- C. NULL
- D. N/A
Answer: B
Explanation:
Reference:https://answers.splunk.com/answers/653427/fillnull-doesnt-work-without-specfying-a-field.html
NEW QUESTION # 116
Field discovery occurs at ___________ time.
- A. search
- B. index
Answer: A
NEW QUESTION # 117
When can a pipe follow a macro?
- A. The current user must own the macro.
- B. The macro must be defined in the current app.
- C. A pipe may always follow a macro.
- D. Only when sharing is set to global for the macro.
Answer: B
NEW QUESTION # 118
Which of the following searches will return events contains a tag name Privileged?
- A. Tag= Priv*
- B. Tag= Priv
- C. Tag= Privileged
- D. Tag= Pri*
Answer: D
NEW QUESTION # 119
A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?
- A. Two.
- B. It depends on whether the two sourcetypes are associated with the same index.
- C. One.
- D. It depends on whether the original fields have the same name.
Answer: A
NEW QUESTION # 120
Which of the following statements describes macros?
- A. A macro is a reusable search string that may have a flexible time range.
- B. A macro is a reusable search string that must have a fixed time range.
- C. A macro is a reusable search string that must contain only a portion of the search.
- D. A macro is a reusable search string that must contain the full search.
Answer: C
Explanation:
Explanation
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros
NEW QUESTION # 121
Which workflow action method can be used when the action type is set to link?
- A. UPDATE
- B. PUT
- C. Search
- D. GET
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/SetupaGETworkflowaction
NEW QUESTION # 122
Which workflow action method can be used the action type is set to link?
- A. UPDATE
- B. PUT
- C. Search
- D. GET
Answer: D
Explanation:
Explanation
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps
* Navigate to Settings > Fields > Workflow Actions.
* Click New to open up a new workflow action form.
* Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu.
Labels can be static or include the value of relevant fields.
* Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
* For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
* Set Action type to link.
* In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
* Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
* Set the Link method to get
* Click Save to save your workflow action definition.
NEW QUESTION # 123
What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?
- A. The user is unable to return to the automatic field extraction workflow.
- B. The user is unable to preview the extractions.
- C. There is a limit to the number of fields that can be extracted.
- D. The extraction is added at index time.
Answer: C
NEW QUESTION # 124
Which of the following searches will return events contains a tag name Privileged?
- A. Tag= Priv*
- B. Tag= Priv
- C. Tag= Privileged
- D. Tag= Pri*
Answer: D
Explanation:
Reference:https://docs.splunk.com/Documentation/PCI/4.1.0/Install/PrivilegedUserActivity
NEW QUESTION # 125
......
Start your SPLK-1002 Exam Questions Preparation: https://www.guidetorrent.com/SPLK-1002-pdf-free-download.html
Realistic SPLK-1002 Dumps Questions To Gain Brilliant Result: https://drive.google.com/open?id=14PRg3N5Sn0ChXDDrmtSy4q7oUv65JuOd