Splunk
SPLK-1002
Q1:
Which of the following can be saved as an event type?
○
A
index=server_48 sourcetype=BETA_881 code=220○
B
index=server_48 sourcetype=BETA_881 code=220 | stats count by code○
C
index=server_48 sourcetype=BETA_881 code=220 | inputlookup append=t servercode.csv○
D
index=server_48 sourcetype=BETA_881 code=220 | stats where code > 220
Splunk
SPLK-1002
Q2:
Which of the following can be saved as an event type?
○
A
index=server_485 sourcetype=BETA_726 code=917 ['inputlookup append=t servercode.csv]○
B
index=server_485 sourcetype=BETA_726 code=917 | stats where code > 200○
C
index=server_485 sourcetype=BETA_726 code=917○
D
index=server_485 sourcetype=BETA_726 code=917 | stats count by code
Splunk
SPLK-1002
Q3:
What is the purpose of a calculated field?
○
A
To automatically add fields to the index using an eval expression rather than manually including an eval command.○
B
To manually add and remove fields at search time related to statistical functions.○
C
To automatically add fields at search time using an eval expression rather than manually including an eval command.○
D
To manually add fields at search time and check for syntax errors.
Splunk
SPLK-1002
Q4:
When using the Field Extractor (FX) to perform a field extraction, which delimiter can be used?
○
A
A period or comma.○
B
A comma.○
C
A tab or space.○
D
Any consistent character.
Splunk
SPLK-1002
Q5:
Which of the following searches can be used to define an event type?
○
A
index=games sourcetype=score [search index=players | fields player_id]○
B
index=games sourcetype=score I where score>9999○
C
index=games sourcetype=score player=* score>9999○
D
index=games sourcetype=score I stats count by player