Splunk Core Certified Power User - SPLK-1002 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)

A. Re-ingest the data and attempt to extract from a new dataset. B. Click on the event where the field was not extracted and choose "Change to Delimited". C. Select an additional sample event with the Field Extractor (FX) and highlight the missing value in the event. D. Edit the regular expression manually.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 2

A user runs the following search:
index-X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother-f Which of the following table headers match the order this command creates?

A. Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase B. Count: product, sum: product, count: action, sum: action C. Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase D. The chart command does not allow for multiple statistical functions.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

Which of the following definitions describes a macro named "samplemacro" that accepts two arguments?

A. samplemacro[2] B. samplemacro(1,2) C. samplemacro[1,2] D. samplemacro(2)

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 4

How does a user display a chart in stack mode?

A. You cannot display a chart in stack mode, only a timechart. B. By turning on the Use Trellis Layout option. C. By using the stack command. D. By changing Stack Mode in the Format menu.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

What does the fillnull command replace null values with, it the value argument is not specified?

A. N/A B. NULL C. 0 D. NaN

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

Which of the following workflow actions can be executed from search results? (select all that apply)

A. Search B. GET C. LOOKUP D. POST

Discussion 0

Correct Answer: A,B,D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Given the following eval statement:
...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

A. There is no equivalent expression using f ilinull B. ... I fillnull fieldl I filinull value="NO-VALUE" field2 C. ... t filinull values=(0,"NO-VALUE") fields=(fieldl,field2) D. ... I filinull value=0 fieldl I fillnull fields

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

Which of the following eval commands will provide a new value for host from src if it exists?

A. | eval host = if (NOT src = host, src, host) B. | eval host = if (isnu11 (src), src, host) C. | eval host = if (isnotnull (src), src, host) D. | eval host = if (src = host, src, host)

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 9

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

A. Authorization B. Accounting C. Authentication D. Access

Discussion 0

Correct Answer: C Vote an answer

Question 10

The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

A. 'weekly_sales($3.99$, $10$) B. 'weekly_sales(3) C. 'weekly_sales(3.99, 10) ' D. 'weekly_sales (3.99, 10)

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 11

Which method in the Field Extractor would extract the port number from the following event? |
10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin <web error>

A. rex command B. Regular expression C. The Field Extractor tool cannot extract regular expressions. D. Delimiter

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).