SPLK-1002 Practice Exam Questions and Answers

A.  

Tags

B.  

Extracted fields

C.  

Output fields for a lookup

D.  

Fields generated from a search string

A.  

Fields and variables.

B.  

Fields and attributes.

C.  

Constraints and fields.

D.  

Constraints and lookups.

A.  

When a log file has values that are separated by the same character, for example, commas.

B.  

When a log file contains empty lines or comments.

C.  

With structured files such as JSON or XML.

D.  

When the file has a header that might provide information about its structure or format.

A.  

example(2)

B.  

example(var1,var2)

C.  

example($,$)

D.  

example[2]

A.  

Event types cannot be used to organize data into categories.

B.  

Event types include formatting of the search results.

C.  

Event types can be shared with Splunk users and added to dashboards.

D.  

Event types do not include a time range.

A.  

Field alias names replace the original field name.

B.  

Field aliases can be used in lookup file definitions.

C.  

Field aliases only normalize data across sources and sourcetypes.

D.  

Field alias names are not case sensitive when used as part of a search.

A.  

eval, coalesce

B.  

transaction, stats

C.  

stats, format

D.  

top, rare

A.  

Rank

B.  

Weight

C.  

Priority

D.  

Precedence

A.  

Event type

B.  

Field alias

C.  

Field extraction

D.  

Tag

A.  

They are both knowledge objects.

B.  

Data models are created out of datasets called pivots.

C.  

Pivot requires users to input SPL searches on data models.

D.  

Pivot allows the creation of data visualizations that present different aspects of a data model.