File Info
| Exam | Splunk Core Certified Power User |
| Number | SPLK-1002 |
| File Name | Splunk.SPLK-1002.ActualTests.2021-01-25.96q.vcex |
| Size | 196 KB |
| Posted | Jan 25, 2021 |
| Download | Splunk.SPLK-1002.ActualTests.2021-01-25.96q.vcex |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
Which one of the following statements about the search command is true?
- It does not allow the use of wildcards.
- It treats field values in a case-sensitive manner.
- It can only be used at the beginning of the search pipeline.
- It behaves exactly like search strings before the first pipe.
Correct answer: D
Explanation:
Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Search/Usethesearchcommand Reference:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Search/Usethesearchcommand
Question 2
Which of the following actions can the eval command perform?
- Remove fields from results.
- Create or replace an existing field.
- Group transactions by one or more fields.
- Save SPL commands to be reused in other searches.
Correct answer: B
Question 3
When can a pipe follow a macro?
- A pipe may always follow a macro.
- The current user must own the macro.
- The macro must be defined in the current app.
- Only when sharing is set to global for the macro.
Correct answer: A
Question 4
Data models are composed of one or more of which of the following datasets? (Choose all that apply.)
- Events datasets
- Search datasets
- Transaction datasets
- Any child of event, transaction, and search datasets
Correct answer: ABC
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels
Question 5
When using the Field Extractor (FX), which of the following delimiters will work? (Choose all that apply.)
- Tabs
- Pipes
- Colons
- Spaces
Correct answer: BD
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep
Question 6
Which group of users would most likely use pivots?
- Users
- Architects
- Administrators
- Knowledge Managers
Correct answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Pivot/IntroductiontoPivot Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Pivot/IntroductiontoPivot
Question 7
When multiple event types with different color values are assigned to the same event, what determines the color displayed for the event?
- Rank
- Weight
- Priority
- Precedence
Correct answer: C
Explanation:
Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Knowledge/Defineeventtypes Reference:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Knowledge/Defineeventtypes
Question 8
Based on the macro definition shown below, what is the correct way to execute the macro in a search string?
- "convert_sales(euro,€,.79)"
- 'convert_sales(euro,€,.79)'
- "convert_sales($euro$,$€$,$.79$)"
- 'convert_sales($euro$,$€$,$.79$)'
Correct answer: B
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros
Question 9
There are several ways to access the field extractor.
Which option automatically identifies the data type, source type, and sample event?
- Event Actions > Extract Fields
- Fields sidebar > Extract New Fields
- Settings > Field Extractions > New Field Extraction
- Settings > Field Extractions > Open Field Extractor
Correct answer: A
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/Managesearchtimefieldextractions Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/Managesearchtimefieldextractions
Question 10
Which of the following statements would help a user choose between the transaction and stats commands?
- stats can only group events using IP addresses.
- The transaction command is faster and more efficient.
- There is a 1000 event limitation with the transaction command.
- Use stats when the events need to be viewed as a single correlated event.
Correct answer: C
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transaction Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transaction
