Splunk Splunk Certifications SPLK-1002 Questions & Answers

• Question 231:

  The macro weekly_sales (2) contains the search string:

  index=games | eval ProductSales = $Price$ * $AmountSold$

  Which of the following will return results?

  A. `weekly sales (3)'

  B. `weekly_sales($3.995, $108)'

  C. 'weekly_sales (3.99, 10)'

  D. `weekly sales (3.99, 10)'

  Correct Answer: C

  To use a search macro in a search string, you need to place a back tick character (`) before and after the macro name1. You also need to use the same number of arguments as defined in the macro2. The macro weekly sales (2) has two arguments: Price and AmountSold. Therefore, you need to provide two values for these arguments when you call the macro. The option A is incorrect because it uses parentheses instead of back ticks around the macro name. The option B is incorrect because it uses underscores instead of spaces in the macro name. The option D is incorrect because it uses spaces instead of commas to separate the argument values. Reference: 1 Use search macros in searches - Splunk Documentation 2 Define search macros in Settings - Splunk Documentation

• Question 232:

  When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

  A. index or source

  B. sourcetype or host

  C. index or sourcetype

  D. sourcetype or source

  Correct Answer: D

  When using the Field Extractor (FX) in Splunk for regex field extraction, it's important to select the context in which you want to perform the extraction. The context is essentially the subset of data you're focusing on for your field extraction task. D. Sourcetype or source: This is the correct option. In the initial steps of using the Field Extractor tool, you're prompted to choose a data type for your field extraction. The options available are typically based on the nature of your data and how it's organized in Splunk. "Sourcetype" refers to the kind of data you're dealing with, a categorization that helps Splunk apply specific processing rules. "Source" refers to the origin of the data, like a specific log file or data input. By selecting either a sourcetype or source, you're narrowing down the dataset on which you'll perform the regex extraction, making it more manageable and relevant.

• Question 233:

  Which of the following is a function of the Splunk Common Information Model (CIM)?

  A. Normalizing data across a Splunk deployment.

  B. Providing templates for reports and dashboards.

  C. Algorithmically shifting events to other indexes.

  D. Reingesting previously indexed data with new field names.

  Correct Answer: A

• Question 234:

  Which of the following is a feature of the Pivot tool?

  A. Creates lookups without using SPL.

  B. Data Models are not required.

  C. Creates reports without using SPL

  D. Datasets are not required.

  Correct Answer: C

  The correct answer is C. Creates reports without using SPL. This is because the Pivot tool is a feature of Splunk that allows you to report on a specific data set without using the Splunk Search Processing Language (SPL). You can use a drag-and-drop interface to design and generate pivots that present different aspects of your data in the form of tables, charts, and other visualizations. You can learn more about the Pivot tool from the Splunk documentation1 or watch a video tutorial2. The other options are incorrect because they do not describe the features of the Pivot tool. The Pivot tool requires data models and datasets to define the data that you want to work with. Data models and datasets are designed by the knowledge managers in your organization. You can learn more about data models and datasets from the Splunk documentation3. The Pivot tool does not create lookups, which are tables that match field values to other field values. You can create lookups using SPL or the Lookup Editor. You can learn more about lookups from the Splunk documentation.

• Question 235:

  Which of the following can be saved as an event type?

  A. index-server_472 sourcetype-BETA_494 code-488 I stats count by code

  B. index=server_472 sourcetype=BETA_494 code=488 [I inputlookup append=t servercode.csv]

  C. index=server_472 sourcetype=BETA_494 code=488 I stats where code > 200

  D. index=server_472 sourcetype=BETA_494 code-488

  Correct Answer: D

  Event types in Splunk are saved searches that categorize data, making it easier to search for specific patterns or criteria within your data. When saving an event type, the search must essentially filter events based on criteria without performing operations that transform or aggregate the data. Here's a breakdown of the options:

  A. The search index-server_472 sourcetype-BETA_494 code-488 | stats count by code performs an aggregation operation (stats count by code), which makes it unsuitable for saving as an event type. Event types are meant to categorize data without aggregating or transforming it.

  B. The search index=server_472 sourcetype=BETA_494 code=488 [ | inputlookup append=t servercode.csv] includes a subsearch and input lookup, which is typically used to enrich or filter events based on external data. This complexity goes beyond simple event categorization.

  C. The search index=server_472 sourcetype=BETA_494 code=488 | stats where code > 200 includes a filtering condition within a transforming command (stats), which again, is not suitable for defining an event type due to the transformation of data. D. The search index=server_472 sourcetype=BETA_494 code-488 is the correct answer as it purely filters events based on index, sourcetype, and a code field condition without transforming or aggregating the data. This is what makes it suitable for saving as an event type, as it categorizes data based on specific criteria without altering the event structure or content.

• Question 236:

  This function of the stats command allows you to return the sample standard deviation of a field.

  A. stdev

  B. dev

  C. count deviation

  D. by standarddev

  Correct Answer: A

• Question 237:

  Which of the following statements about calculated fields in Splunk is true?

  A. Calculated fields cannot be chained together to create more complex fields

  B. Calculated fields can be chained together to create more complex fields.

  C. Calculated fields can only be used in dashboards.

  D. Calculated fields can only be used in saved reports.

  Correct Answer: B

  The correct answer is B. Calculated fields can be chained together to create more complex fields.

  Calculated fields are fields that are added to events at search time by using eval expressions. They can be used to perform calculations with the values of two or more fields already present in those events. Calculated fields can be defined with Splunk Web or in the props.conf file. They can be used in searches, reports, dashboards, and data models like any other extracted field1. Calculated fields can also be chained together to create more complex fields. This means that you can use a calculated field as an input for another calculated field. For example, if you have a calculated field named total that sums up the values of two fields named price and tax, you can use the total field to create another calculated field named discount that applies a percentage discount to the total field. To do this, you need to define the discount field with an eval expression that references the total field, such as: discount = total * 0.9 This will create a new field named discount that is equal to 90% of the total field value for each event2. References: About calculated fields Chaining calculated fields

• Question 238:

  Consider the the following search run over a time range of last 7 days:

  index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane

  Which option is used to change the default time span so that results are grouped into 12 hour intervals?

  A. span=12h

  B. timespan=12h

  C. span=12

  D. timespan=12

  Correct Answer: A

  The span option is used to specify the time span for the timechart command. The span value can be a number followed by a time unit, such as h for hour, d for day, w for week, etc. The span value determines how the data is grouped into time buckets. For example, span=12h means that the data is grouped into 12-hour intervals. The timespan option is not a valid option for the timechart command2

  1: Splunk Core Certified Power User Track, page 9. 2: Splunk Documentation, timechart command.

• Question 239:

  Which of the following eval commands will provide a new value for host from src if it exists?

  A. | eval host = if (isnu11 (src), src, host)

  B. | eval host = if (NOT src = host, src, host)

  C. | eval host = if (src = host, src, host)

  D. | eval host = if (isnotnull (src), src, host)

  Correct Answer: D

  The eval command is a Splunk command that allows you to create or modify fields using expressions .

  The if function is an expression that evaluates a condition and returns a value based on whether the condition is true or false. The syntax of the if function is if(X,Y,Z), where X is the condition, Y is the value to return if X is true, and Z is the

  value to return if X is false.

  The isnotnull function is an expression that returns true if the argument is not null, and false otherwise. The syntax of the isnotnull function is isnotnull(X), where X is the argument to check. Therefore, the expression if (isnotnull (src), src, host)

  returns the value of src if it is not null, and the value of host otherwise. This means that it will provide a new value for host from src if it exists, and keep the original value of host otherwise.

• Question 240:

  It is mandatory for the lookup file to have this for an automatic lookup to work.

  A. Source type

  B. At least five columns

  C. Timestamp

  D. Input filed

  Correct Answer: D