Cisco®
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
All Vendors
  2. Home
  3. Exams
  4. Splunk®
  5. SPLK-1002

Free Splunk® SPLK-1002 Exam Braindumps (page: 20)

Page 10 of 54
PDF with 210 Questions

Which of the following searches show a valid use of a macro? (Choose all that apply.)

  1. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
  2. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
  3. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
  4. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

Answer(s): A,C



A user wants to convert numeric field values to strings and also to sort on those values. Which command should be used first, the eval or the sort?

  1. It doesn't matter whether eval or sort is used first.
  2. Convert the numeric to a string with eval first, then sort.
  3. Use sort first, then convert the numeric to a string with eval.
  4. You cannot use the sort command and the eval command on the same field.

Answer(s): C



Which Knowledge Object does the Splunk Common Information Model (CIM) use to normalize data, in addition to field aliases, event types, and tags?

  1. Macros
  2. Lookups
  3. Workflow actions
  4. Field extractions

Answer(s): B,D


Reference:

https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime



Which of the following statements describe data model acceleration? (Choose all that apply.)

  1. Root events cannot be accelerated.
  2. Accelerated data models cannot be edited.
  3. Private data models cannot be accelerated.
  4. You must have administrative permissions or the accelerate_datamodel capability to accelerate a data model.

Answer(s): B,C,D

Explanation:






Post your Comments and Discuss Splunk® SPLK-1002 exam prep with other Community members:

SPLK-1002 Exam Discussions & Posts