SPLK-1002 시험 - Splunk실제시험문제와 답 - 64문항

Question No : 1

Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)

A.Tabs
B.Pipes
C.Spaces
D.Commas

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep

Question No : 2

What do events in a transaction have in common?

A.All events in a transaction must have the same timestamp.
B.All events in a transaction must have the same source type.
C.All events in a transaction must have the exact same set of fields.
D.All events in a transaction must be related by one or more fields.

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Abouttransactions

Question No : 3

Which of the following knowledge objects represents the output of an eval expression?

A.Eval fields
B.Calculated fields
C.Field extractions
D.Calculated lookups

정답:
Explanation:
Reference: https://docs.splunk.com/Splexicon:Calculatedfield

Question No : 4

Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)

A.CIM is a methodology for normalizing data.
B.CIM can correlate data from different sources.
C.The Knowledge Manager uses the CIM to create knowledge objects.
D.CIM is an app that can coexist with other apps on a single Splunk deployment.

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview

Question No : 5

By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

A.Turned off.
B.Turned on.
C.Determined automatically based on the source type.
D.Determined automatically based on the data source.

정답:

Question No : 6

Which of the following statements would help a user choose between the transaction and stars commands?

A.stats can only group events using IP addresses.
B.The transaction command is faster and more efficient.
C.There is a 1000 event limitation with the transaction command.
D.Use stats when the events need to be viewed as a single correlated event.

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transaction

Question No : 7

There are several ways to access the field extractor.
Which option automatically identifies the data type, source type, and sample event?

A.Event Actions > Extract Fields
B.Fields sidebar > Extract New Fields
C.Settings > Field Extractions > New Field Extraction
D.Settings > Field Extractions > Open Field Extractor

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/Managesearchtimefieldextractions

Question No : 8

Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

A."convert_sales(euro,,.79)"
B.'convert_sales(euro,,.79)'
C."convert_sales($euro$,$$,$.79$)"
D.'convert_sales($euro$,$$,$.79$)'

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros

Question No : 9

When multiple event types with different color values are assigned to the same event, what determines the color displayed for the event?

A.Rank
B.Weight
C.Priority
D.Precedence

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Knowledge/Defineeventtypes

Question No : 10

Which group of users would most likely use pivots?

A.Users
B.Architects
C.Administrators
D.Knowledge Managers

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Pivot/IntroductiontoPivot

Question No : 11

When using the Field Extractor (FX), which of the following delimiters will work? (Choose all that apply.)

A.Tabs
B.Pipes
C.Colons
D.Spaces

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep

Question No : 12

Data models are composed of one or more of which of the following datasets? (Choose all that apply.)

A.Events datasets
B.Search datasets
C.Transaction datasets
D.Any child of event, transaction, and search datasets

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels

Question No : 13

When can a pipe follow a macro?

A.A pipe may always follow a macro.
B.The current user must own the macro.
C.The macro must be defined in the current app.
D.Only when sharing is set to global for the macro.

정답:

Question No : 14

Which of the following actions can the eval command perform?

A.Remove fields from results.
B.Create or replace an existing field.
C.Group transactions by one or more fields.
D.Save SPL commands to be reused in other searches.

정답:

Question No : 15

Which one of the following statements about the search command is true?

A.It does not allow the use of wildcards.
B.It treats field values in a case-sensitive manner.
C.It can only be used at the beginning of the search pipeline.
D.It behaves exactly like search strings before the first pipe.

정답:
Explanation:
Reference: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2003/Search/Usethesearchcommand

Splunk SPLK-1002 시험