Get New 2021 Splunk exam SPLK-1002 Dumps Bundle On flat Updated Dumps!
Full SPLK-1002 Practice Test and 179 unique questions with explanations waiting just for you, get it now!
NEW QUESTION 73
What is the correct syntax to search for a tag associated with a value on a specific fields?
- A. Tag-<field?
- B. Tag<filed(tagname.)
- C. Tag=<filed>::<tagname>
- D. Tag::<filed>=<tagname>
Answer: D
NEW QUESTION 74
After manually editing; a regular expression (regex), which of the following statements is true?
- A. The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.
- B. Changes made manually can be reverted in the Field Extractor (FX) UI.
- C. It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.
- D. It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.
Answer: A
NEW QUESTION 75
Which workflow action method can be used the action type is set to link?
- A. GET
- B. UPDATE
- C. Search
- D. PUT
Answer: A
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps
* Navigate to Settings > Fields > Workflow Actions.
* Click New to open up a new workflow action form.
* Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu. Labels can be static or include the value of relevant fields.
* Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
* For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
* Set Action type to link.
* In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
* Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
* Set the Link method to get.
* Click Save to save your workflow action definition.
NEW QUESTION 76
Which workflow action method can be used the action type is set to link?
- A. GET
- B. UPDATE
- C. Search
- D. PUT
Answer: A
Explanation:
Explanation
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps
* Navigate to Settings > Fields
* Click New to open up a new workflow action form.
* Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu.
Labels can be static or include the value of relevant fields.
* Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
* For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
* Set Action type to link.
* In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
* Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
* Set the Link method to get
* Click Save to save your workflow action definition.
NEW QUESTION 77
When should transaction be used?
- A. When calculating results from one or more fields.
- B. Only in a large distributed Splunk environment.
- C. When grouping events results in over 1000 events in each group.
- D. When event grouping is based on start/end values.
Answer: D
NEW QUESTION 78
Which of the following statements is true, especially in largo environments?
- A. The stats command is faster and more efficient than the transaction command
- B. The transaction command is faster and more efficient than the stats command.
- C. Use the transaction command when you want to see the results of a calculation.
- D. Use the scats command when you next to group events by two or more fields.
Answer: A
NEW QUESTION 79
Which of the following statements about data models and pivot are true? (select all that apply)
- A. Pivot requires users to input SPL searches on data models.
- B. They are both knowledge objects.
- C. Data models are created out of datasets called pivots.
- D. Pivot allows the creation of data visualizations that present different aspects of a data model.
Answer: C,D
NEW QUESTION 80
Which one of the following statements about the search command is true?
- A. It does not allow the use of wildcards.
- B. It behaves exactly like search strings before the first pipe.
- C. It can only be used at the beginning of the search pipeline.
- D. It treats field values in a case-sensitive manner.
Answer: B
Explanation:
Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Search/Usethesearchcommand
NEW QUESTION 81
To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?
- A. Index-main | REJECT trans sessionid
- B. Index=main | transaction sessionid | where transaction=reject''
- C. Index-main | transaction sessionid | search REJECT
- D. Index=main | transaction sessionid | whose transaction=reject
Answer: C
NEW QUESTION 82
Which are valid ways to create an event type? (select all that apply)
- A. By editing the event_type stanza in the props.conf file.
- B. By using the searchtypes command in the search bar.
- C. By selecting an event in search results and clicking Event Actions > Build Event Type.
- D. By going to the Settings menu and clicking Event Types > New.
Answer: C,D
NEW QUESTION 83
Which one of the following statements about the searchcommand is true?
- A. It does not allow the use of wildcards.
- B. It behaves exactly like search strings before the first pipe.
- C. It can only be used at the beginning of the search pipeline.
- D. It treats field values in a case-sensitive manner.
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Search/Usethesearchcommand
NEW QUESTION 84
This tab shows you the event patterns in the results of a specific search.
- A. patterns
- B. visualization
- C. statistics
Answer: A
NEW QUESTION 85
Running a scheduled saved report______.
- A. Returns the results from the last time the report was saved
- B. Returns a fresh results set
Answer: B
NEW QUESTION 86
Which of the following statements describes field aliases?
- A. Field aliases can be used in lookup file definitions.
- B. Field alias names are not case sensitive when used as part of a search.
- C. Field aliases only normalize data across sources and sourcetypes.
- D. Field alias names replace the original field name.
Answer: B
NEW QUESTION 87
The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)
- A. The person in the organization running the report does not have access to the index.
- B. The dashboard is private.
- C. The extraction is private-
- D. Fast mode is enabled.
Answer: A,B
NEW QUESTION 88
Which of the following searches would return a report of sales by product-name?
- A. chart sales by product_name
- B. chart sum(price) as sales by product_name
- C. stats sum(price) as sales over product_name
- D. timechart list(sales), values(product_name)
Answer: C
Explanation:
Reference:
http://hilllaneconsulting.co.uk/blog/?p=640
NEW QUESTION 89
What does the following search do?
index=condlog type=mysterymeat action=eaten I scats count as cornlog_count by us:
- A. Creates a table of the total count of users and split by corndogs.
- B. Creates a table of the total count of mysterymeat corndogs split by user.
- C. Creates a table that groups the total number of users by vegetarian corndogs.
- D. Creates a table with the count of all types of corndogs eaten split by user.
Answer: A
NEW QUESTION 90
The Splunk CIM Add-on includes data models in a __________ format.
Select your answer.
- A. JSON
- B. XML
- C. MySQL
Answer: A
NEW QUESTION 91
Which of the following searches would return a report of sales by product-name?
- A. chart sales by product_name
- B. chart sum(price) as sales by product_name
- C. timechart list(sales), values(product_name)
- D. stats sum(price) as sales over product_name
Answer: B
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Chart
https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Stats
NEW QUESTION 92
Which of the following statements describe calculated fields? (select all that apply)
- A. Calculated fields can be used in the search bar.
- B. Calculated fields are shortcuts for performing calculations using the eval command.
- C. Calculated fields can be based on an extracted field.
- D. Calculated fields can only be applied to host and sourcetype.
Answer: B,C
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields
NEW QUESTION 93
Which of the following can be used with the eval command tostring function (select all that apply)
- A. ''duration''
- B. ''commas''
- C. ''Decimal''
- D. ''hex''
Answer: A,B,D
Explanation:
Reference:https://splunkonbigdata.com/2018/10/27/usage-of-splunk-eval-function-tostring/
NEW QUESTION 94
When should transaction be used?
- A. Only in a large distributed Splunk environment.
- B. When calculating results from one or more fields.
- C. When grouping events results in over 1000 events in each group.
- D. When event grouping is based on start/end values.
Answer: B
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Abouttransactions
NEW QUESTION 95
......
[Sep-2021] Pass Splunk SPLK-1002 Exam in First Attempt Guaranteed: https://drive.google.com/open?id=1PfMBw1Jn_JYm8aqBGG6rq4g_X1HqWONd
Reduce Your Chance of Failure in SPLK-1002 Exam: https://www.dumpstillvalid.com/SPLK-1002-prep4sure-review.html
