Splunk Splunk Certifications SPLK-1002 Questions & Answers

• Question 191:

  Which of the following are required to create a POST workflow action?

  A. Label, URI, search string.

  B. XMI attributes, URI, name.

  C. Label, URI, post arguments.

  D. URI, search string, time range picker.

  Correct Answer: C

  POST workflow actions are custom actions that send a POST request to a web server when you click on a field value in your search results. POST workflow actions can be configured with various options, such as label name, base URL, URI parameters, post arguments, app context, etc. One of the options that are required to create a POST workflow action is post arguments. Post arguments are key-value pairs that are sent in the body of the POST request to provide additional information to the web server. Post arguments can include field values from your data by using dollar signs around the field names.

• Question 192:

  When should you use the transaction command instead of the scats command?

  A. When you need to group on multiple values.

  B. When duration is irrelevant in search results. .

  C. When you have over 1000 events in a transaction.

  D. When you need to group based on start and end constraints.

  Correct Answer: D

  The transaction command is used to group events into transactions based on some common characteristics, such as fields, time, or both. The transaction command can also specify start and end constraints for the transactions, such as a field value that indicates the beginning or the end of a transaction. The stats command is used to calculate summary statistics on the events, such as count, sum, average, etc. The stats command cannot group events based on start and end constraints, but only on fields or time buckets. Therefore, the transaction command should be used instead of the stats command when you need to group events based on start and end constraints.

• Question 193:

  A user wants to convert numeric field values to strings and also to sort on those values.

  Which command should be used first, the eval or the sort?

  A. It doesn't matter whether eval or sort is used first.

  B. Convert the numeric to a string with eval first, then sort.

  C. Use sort first, then convert the numeric to a string with eval.

  D. You cannot use the sort command and the eval command on the same field.

  Correct Answer: C

  The eval command is used to create new fields or modify existing fields based on an expression2. The sort command is used to sort the results by one or more fields in ascending or descending order2. If you want to convert numeric field values to strings and also sort on those values, you should use the sort command first, then use the eval command to convert the values to strings2. This way, the sort command will use the original numeric values for sorting, rather than the converted string values which may not sort correctly. Therefore, option C is correct, while options A, B and D are incorrect.

• Question 194:

  What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

  A. Macros.

  B. Field aliases.

  C. The rename command.

  D. CIM does not work with different names for the same field.

  Correct Answer: B

  The Splunk Common Information Model (CIM) add-on helps you normalize your data from different sources and make it easier to analyze and report on it3. One of the functionalities that the CIM add-on relies on to normalize fields with different names is field aliases3. Field aliases allow you to assign an alternative name to an existing field without changing the original field name or value2. By using field aliases, you can map different field names from different sources or sourcetypes to a common field name that conforms to the CIM standard3. Therefore, option B is correct, while options A, C and D are incorrect.

• Question 195:

  A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

  A. Both will appear in the All Fields list, but only if the alias is specified in the search.

  B. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

  C. The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

  D. The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

  Correct Answer: B

  A field alias is a way to assign an alternative name to an existing field without changing the original field name or value2. You can use field aliases to make your field names more consistent or descriptive across different sources or sourcetypes2. When you run a search without any transforming commands in Smart Mode, Splunk automatically identifies and displays interesting fields in your results2. Interesting fields are fields that appear in at least 20 percent of events or have high variability among values2. If you have created a field alias based on an original field, both the original field name and the alias name will appear in the Interesting Fields list if they meet these criteria2. However, only one of them will appear in each event depending on which one you have specified in your search string2. Therefore, option B is correct, while options A, C and D are incorrect.

• Question 196:

  Data model are composed of one or more of which of the following datasets? (select all that apply.)

  A. Events datasets

  B. Search datasets

  C. Transaction datasets

  D. Any child of event, transaction, and search datasets

  Correct Answer: ABC

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels

  Data models are collections of datasets that represent your data in a structured and hierarchical way. Data models define how your data is organized into objects and fields. Data models can be composed of one or more of the following datasets:

  Events datasets: These are the base datasets that represent raw events in Splunk. Events datasets can be filtered by constraints, such as search terms, sourcetypes, indexes, etc.

  Search datasets: These are derived datasets that represent the results of a search on events or other datasets. Search datasets can use any search command, such as stats, eval, rex, etc., to transform the data.

  Transaction datasets: These are derived datasets that represent groups of events that are related by fields, time, or both. Transaction datasets can use the transaction command or event types with transactiontype=true to create transactions.

• Question 197:

  When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

  A. The regex can no longer be edited.

  B. The field being extracted will be required for all future events.

  C. The events without the required field will not display in searches.

  D. Only events with the required string will be included in the extraction.

  Correct Answer: D

  The Field Extractor (FX) allows you to use regular expressions (regex) to extract fields from your events using a graphical interface or by manually editing the regex2. When you use the FX to perform a regex field extraction, you can use the require option to specify a string that must be present in an event for it to be included in the extraction2. This way, you can filter out events that do not contain the required string and focus on the events that are relevant for your extraction2. Therefore, option D is correct, while options A, B and C are incorrect.

• Question 198:

  The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

  A. Fast mode is enabled.

  B. The dashboard is private.

  C. The extraction is private-

  D. The person in the organization running the report does not have access to the index.

  Correct Answer: CD

  The Field Extractor (FX) is a tool that helps you extract fields from your events using a graphical interface2. You can create a report using a custom field extracted by the FX and share it with other users in your organization2. However, if another user runs the shared report and no results are returned, there could be two possible reasons. One reason is that the extraction is private, which means that only you can see and use the extracted field2. To make the extraction available to other users, you need to make it global or app-level2. Therefore, option C is correct. Another reason is that the other user does not have access to the index where the events are stored2. To fix this issue, you need to grant the appropriate permissions to the other user for the index2. Therefore, option D is correct. Options A and B are incorrect because they are not related to the field extraction or the report.

• Question 199:

  Which of the following describes the Splunk Common Information Model (CIM) add-on?

  A. The CIM add-on uses machine learning to normalize data.

  B. The CIM add-on contains dashboards that show how to map data.

  C. The CIM add-on contains data models to help you normalize data.

  D. The CIM add-on is automatically installed in a Splunk environment.

  Correct Answer: C

  The Splunk Common Information Model (CIM) add-on is a Splunk app that contains data models to help you normalize data from different sources and formats. The CIM add-on defines a common and consistent way of naming and categorizing fields and events in Splunk. This makes it easier to correlate and analyze data across different domains, such as network, security, web, etc. The CIM add-on does not use machine learning to normalize data, but rather relies on predefined field names and values. The CIM add-on does not contain dashboards that show how to map data, but rather provides documentation and examples on how to use the data models. The CIM add-on is not automatically installed in a Splunk environment, but rather needs to be downloaded and installed from Splunkbase.

• Question 200:

  In what order arc the following knowledge objects/configurations applied?

  A. Field Aliases, Field Extractions, Lookups

  B. Field Extractions, Field Aliases, Lookups

  C. Field Extractions, Lookups, Field Aliases

  D. Lookups, Field Aliases, Field Extractions

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/WhatisSplunkknowledge

  Knowledge objects are entities that you create to add knowledge to your data and make it easier to search and analyze2. Some examples of knowledge objects are field extractions, field aliases and lookups2. Field extractions are methods that extract fields from your raw data using various techniques such as regular expressions, delimiters or key-value pairs2. Field aliases are ways to assign alternative names to existing fields without changing the original field names or values2. Lookups are ways to enrich your data with additional information from external sources such as CSV files or databases2. The order in which these knowledge objects/configurations are applied is as follows: field extractions, field aliases and then lookups2. This means that Splunk first extracts fields from your raw data, then applies any aliases to the extracted fields and then performs any lookups on the aliased fields2. Therefore, option B is correct, while options A, C and D are incorrect.