Practice SPLK-1002 Questions With Certification guide Q&A from Training Expert [Q39-Q57] : Top Exam Collection : http://blog.topexamcollection.com

FRAGE 39
This function of the stats command allows you to identify the number of values a field has.

max

distinct_count

fields

count

FRAGE 40
The following searches will return the same results. SEARCH 1: ssh error SEARCH 2: ssh AND error

Wahr

Falsch

FRAGE 41
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

CIM is a methodology for normalizing data.

CIM can correlate data from different sources.

The Knowledge Manager uses the CIM to create knowledge objects.

CIM is an app that can coexist with other apps on a single Splunk deployment.

FRAGE 42
What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid,
icid | timechart avg(duration)

The average time elapsed during each transaction for all transactions

The average time for each event within each transaction

The average time between each transaction

FRAGE 43
What is required for a macro to accept three arguments?

The macro’s name ends with (3).

The macro’s name starts with (3).

The macro’s argument count setting is 3 or more.

Nothing, all macros can accept any number of arguments.

FRAGE 44
Which of the following statements describes POST workflow actions?

Configuration of a POST workflow action includes choosing a sourcetype.

POST workflow actions can be configured to send email to the URI location.

By default, POST workflow actions are shown in both the event and field menus.

POST workflow actions can be configured to send POST arguments to the URI location.

FRAGE 45
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Custom visualizations

Pre-configured data models

Fields and event category tags

Automatic data model acceleration

FRAGE 46
How many ways are there to access the Field Extractor Utility?

3

4

1

5

FRAGE 47
Which are valid ways to create an event type? (select all that apply)

By using the searchtypes command in the search bar.

By editing the event_type stanza in the props.conf file.

By going to the Settings menu and clicking Event Types > New.

By selecting an event in search results and clicking Event Actions > Build Event Type.

FRAGE 48
Which statement is true?

Pivot is used for creating datasets.

Data model are randomly structured datasets.

Pivot is used for creating reports and dashboards.

In most cases, each Splunk user will create their own data model.

FRAGE 49
Which command can include both an overand a byclause to divide results into sub-groupings?

chart

stats

xyseries

transaction

FRAGE 50
__________ datasets can be added to root dataset to narrow down the search

parent

extracted

event

child

FRAGE 51
What does the fillnull command replace null values with, it the value argument is not specified?

0

K.A.

NaN

NULL

FRAGE 52
Which workflow action method can be used when the action type is set to link?

GET

PUT

Suche

UPDATE

FRAGE 53
A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

It doesn’t matter whether eval or sort is used first.

Convert the numeric to a string with eval first, then sort.

Use sort first, then convert the numeric to a string with eval.

You cannot use the sort command and the eval command on the same field.

FRAGE 54
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

CIM is a methodology for normalizing data.

CIM can correlate data from different sources.

The Knowledge Manager uses the CIM to create knowledge objects.

CIM is an app that can coexist with other apps on a single Splunk deployment.

FRAGE 55
When using the transaction command, what does the argument maxspan do?

Sets the maximum total time between events in a transaction.

Sets the maximum length of all events within a transaction.

Sets the maximum total time between the earliest and latest events in a transaction.

Sets the maximum length that any single event can reach to be included in the transaction.

FRAGE 56
In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

status

Gastgeber

count

FRAGE 57
This search user!=*_________________.

displays only events that contain a value for user

displays all events

displays only events that do NOT contain a value for user

Practice SPLK-1002 Questions With Certification guide Q&A from Training Expert [Q39-Q57]

Exam Details