SPLK-1002 Practice Online

Question 1

What is required for a macro to accept three arguments?

A : The macro's name ends with (3).

B : The macro's name starts with (3).

C : The macro's argument count setting is 3 or more.

D : Nothing, all macros can accept any number of arguments.

Answer: A

Question 2

Which of the following statements describe the search below? (select all that apply)Index=main I transaction clientip host maxspan=30s maxpause=5s

A : Events in the transaction occurred within 5 seconds.

B : It groups events that share the same clientip and host.

C : The first and last events are no more than 5 seconds apart.

D : The first and last events are no more than 30 seconds apart.

Answer: A,B,D

Question 3

In what order arc the following knowledge objects/configurations applied?

A : Field Aliases, Field Extractions, Lookups

B : Field Extractions, Field Aliases, Lookups

C : Field Extractions, Lookups, Field Aliases

D : Lookups, Field Aliases, Field Extractions

Answer: B

Question 4

Which of the following are valid options to speed up reports? (Select all the apply.)

A : Edit permissions

B : Edit description

C : Edit acceleration

D : Edit schedule

Answer: C

Question 5

Which of the following statements describe calculated fields? (select all that apply)

A : Calculated fields can be used in the search bar.

B : Calculated fields can be based on an extracted field.

C : Calculated fields can only be applied to host and sourcetype.

D : Calculated fields are shortcuts for performing calculations using the eval command.

Answer: A,B,D

Name:	Splunk Core Certified Power User
Exam Code:	SPLK-1002
Certification:	Splunk Core Certified Power User
Vendor:	Splunk
Total Questions:	290
Last Updated:	Nov 26, 2024