Splunk Splunk Core Certified Power User SPLK-1002 Questions & Answers

• Question 1:

  Which statement is true?

  A. Pivot is used for creating datasets.

  B. Data models are randomly structured datasets.

  C. Pivot is used for creating reports and dashboards.

  D. In most cases, each Splunk user will create their own data model.

  Correct Answer: C

  The statement that pivot is used for creating reports and dashboards is true. Pivot is a graphical interface that allows you to create tables, charts, and visualizations from data models. Data models are structured datasets that define how data is organized and categorized. Pivot does not create datasets, but uses existing ones.

• Question 2:

  When can a pipe follow a macro?

  A. A pipe may always follow a macro.

  B. The current user must own the macro.

  C. The macro must be defined in the current app.

  D. Only when sharing is set to global for the macro.

  Correct Answer: A

  A macro is a way to save a segment of a search string as a variable and reuse it in other searches2. A macro can be followed by a pipe, which is a symbol that separates commands in a search pipeline2. A pipe may always follow a macro, regardless of who owns the macro, where the macro is defined or how the macro is shared2. For example, if you have a macro called us_sales that returns events from the US region, you can use it in a search like this: us_sales | stats sum (price) by product2. This search will use the macro to filter the events and then calculate the total price for each product2. Therefore, option A is correct, while options B, C and D are incorrect because they are not conditions that affect whether a pipe can follow a macro.

• Question 3:

  Consider the following search:

  Index=web sourcetype=access_combined

  The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

  A. index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID

  B. index=web sourcetype=access_combined JSESSIONID

  C. index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151

  D. index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151

  Correct Answer: B

• Question 4:

  Consider the following search:

  index=web sourcetype=access_corabined

  The log shows several events that share the same jsesszonid value (SD462K101O2F267).

  View the events as a group.

  From the following list, which search groups events by jSSESSIONID?

  A. index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267

  B. index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID

  C. index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267

  D. index=web sourcetype=access_combined JSESSTONID

  Correct Answer: A

  The transaction command groups events that share a common value in a specified field, such as JSESSIONID, and that occur within a specified time range. The search command filters the results to show only the events that match the given value of JSESSIONID. This search groups the events by JSESSIONID and then shows only the events that have the value SD462K101C2F267 for JSESSIONID2

  1: Splunk Core Certified Power User Track, page 9. 2: Splunk Documentation, transaction command.

• Question 5:

  When a search returns __________, you can view the results as a list.

  A. a list of events

  B. transactions

  C. statistical values

  Correct Answer: C

• Question 6:

  Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

  A. Macros

  B. Lookups

  C. Workflow actions

  D. Field extractions

  Correct Answer: B

  Normalize your data for each of these fields using a combination of field aliases, field extractions, and lookups. https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsear chtime

• Question 7:

  Which of the following data models are included in the Splunk Common Information Model (CIM) add-on? (select all that apply)

  A. User permissions

  B. Alerts

  C. Databases

  D. Email

  Correct Answer: BD

  The Splunk Common Information Model (CIM) Add-on includes a variety of data models designed to normalize data from different sources to allow for cross-source reporting and analysis. Among the data models included, Alerts (Option B) and Email (Option D) are part of the CIM. The Alerts data model is used for data related to alerts and incidents, while the Email data model is used for data pertaining to email messages and transactions. User permissions (Option A) and Databases (Option C) are not data models included in the CIM; rather, they pertain to aspects of data access control and specific types of data sources, respectively, which are outside the scope of the CIM's predefined data models.

• Question 8:

  Which command is used to create choropleth maps?

  A. geostats

  B. cluster

  C. geom

  Correct Answer: C

• Question 9:

  What other syntax will produce exactly the same results as | chart count over vendor_action by user?

  A. | chart count by vendor_action, user

  B. | chart count over vendor_action, user

  C. | chart count by vendor_action over user

  D. | chart count over user by vendor_action

  Correct Answer: A

  https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Chart

• Question 10:

  What are the expected results for a search that contains the command | where A=B?

  A. Events that contain the string value where A=B.

  B. Events that contain the string value A=B.

  C. Events where values of field are equal to values of field B.

  D. Events where field A contains the string value B.

  Correct Answer: C

  The correct answer is C. Events where values of field A are equal to values of field B.

  The where command is used to filter the search results based on an expression that evaluates to true or false. The where command can compare two fields, two values, or a field and a value. The where command can also use functions,

  operators, and wildcards to create complex expressions1.

  The syntax for the where command is:

  | where

  The expression can be a comparison, a calculation, a logical operation, or a combination of these. The expression must evaluate to true or false for each event. To compare two fields with the where command, you need to use the field names

  without any quotation marks. For example, if you want to find events where the values for the field A match the values for the field B, you can use the following syntax:

  | where A=B

  This will return only the events where the two fields have the same value. The other options are not correct because they use different syntax or fields that are not related to the where command. These options are:

  A. Events that contain the string value where A=B: This option uses the string value where A=B as a search term, which is not valid syntax for the where command. This option will return events that have the literal text "where A=B" in them. B. Events that contain the string value A=B: This option uses the string value A=B as a search term, which is not valid syntax for the where command. This option will return events that have the literal text "A=B" in them. D. Events where field A contains the string value B: This option uses quotation marks around the value B, which is not valid syntax for comparing fields with the where command. Quotation marks are used to enclose phrases or exact matches in a search2. This option will return events where the field A contains the string value "B". References: where command usage Search command cheatsheet