Splunk Splunk Certifications SPLK-1002 Questions & Answers

• Question 21:

  By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

  A. Turned off

  B. Turned on

  C. Determined automatically based on the sourcetype.

  D. Determined automatically based on the data source.

  Correct Answer: D

  By default, acceleration is determined automatically based on the data source in the Splunk Common Information Model (CIM) add-on. The Splunk CIM Add-on is an app that provides common data models for various domains, such as network traffic, web activity, authentication, etc. The CIM Add-on allows you to normalize and enrich your data using predefined fields and tags. The CIM Add-on also allows you to accelerate your data models for faster searches and reports. Acceleration is a feature that pre-computes summary data for your data models and stores them in tsidx files. Acceleration can improve the performance and efficiency of your searches and reports that use data models. By default, acceleration is determined automatically based on the data source in the CIM Add-on. This means that Splunk will decide whether to enable or disable acceleration for each data model based on some factors, such as data volume, data type, data model complexity, etc. However, you can also manually enable or disable acceleration for each data model by using the Settings menu or by editing the datamodels.conf file.

• Question 22:

  Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

  A. POST

  B. Search

  C. GET

  D. Format

  Correct Answer: A

  The type of workflow action that sends field values to an external resource (e.g. a ticketing system) is POST. A POST workflow action allows you to send a POST request to a URI location with field values or static values as arguments. For example, you can use a POST workflow action to create a ticket in an external system with information from an event.

• Question 23:

  When would transaction be used instead of stats?

  A. To group events based on a single field value.

  B. To see results of a calculation.

  C. To have a faster and more efficient search.

  D. To group events based on start/end values.

  Correct Answer: D

  The transaction command is used to group events that are related by some common fields or conditions, such as start/end values, time span, or pauses. The stats command is used to calculate statistics on a group of events by a common field value. References Splunk Community Splunk Transaction - Exact Details You Need

• Question 24:

  How is an event type created from the search window? (select all that apply)

  A. In the top right corner, click Save As > Event Type.

  B. In an event's detail dropdown, click Event Actions > Build Event Type.

  C. Edit eventtypes.conf and add a new stanza.

  D. Add | eventtype to the SPL and execute the search.

  Correct Answer: AC

  In Splunk, you can create an event type from the search window by running a search that would make a good event type, then clicking Save As and selecting Event Type1. This opens the Save as Event Type dialog, where you can provide

  the event type name and optionally apply tags to it1.

  You can also create an event type by editing the eventtypes.conf file and adding a new stanza1. Each stanza in the eventtypes.conf file represents an event type1. The stanza name is the name of the event type, and the search attribute

  specifies the search string that defines the event type1.

  It's important to note that while you can use the eventtype command in a search to find events associated with a specific event type, adding | eventtype to the SPL and executing the search does not create a new event type1. Similarly,

  clicking Event Actions > Build Event Type in an event's detail dropdown does not create a new event type1.

• Question 25:

  The timechart command buckets data in time intervals depending on:

  A. the number of events returned

  B. the selected time range

  C. the type of visualization selected

  Correct Answer: B

  The timechart command buckets data in time intervals depending on the selected time range2. The timechart command is similar to the chart command but it automatically groups events into time buckets based on the _time field2. The size of the time buckets depends on the time range that you select for your search. For example, if you select Last 24 hours as your time range, Splunk will use 30-minute buckets for your timechart. If you select Last 7 days as your time range, Splunk will use 4-hour buckets for your timechart2. Therefore, option B is correct, while options A and C are incorrect because they are not factors that affect the size of the time buckets.

• Question 26:

  What will you learn from the results of the following search?

  sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

  A. The average time elapsed during each transaction for all transactions

  B. The average time for each event within each transaction

  C. The average time between each transaction

  Correct Answer: A

• Question 27:

  Splunk alerts can be based on search that run______. (Select all that apply.)

  A. in real-time

  B. on a regular schedule

  C. and have no matching events

  Correct Answer: AB

  Splunk alerts can be based on searches that run in real-time or on a regular schedule3. An alert is a way to monitor your data and get notified when certain conditions are met3. You can create an alert by specifying a search and a triggering condition3. You can also specify how often you want to run the search and how you want to receive the alert notifications3. You can run the alert search in real-time, which means that it continuously monitors your data as it streams into Splunk3. Alternatively, you can run the alert search on a regular schedule, which means that it runs at fixed intervals such as every hour or every day3. Therefore, options A and B are correct, while option C is incorrect because it is not a way to run an alert search.

• Question 28:

  The time range specified for a historical search defines the ____________ .------ questionable on ans

  A. Amount of data shown on the timeline as data streams in

  B. Amount of data fetched from index matching that time range

  C. Time range for the static results

  Correct Answer: B

  The time range specified for a historical search defines the amount of data fetched from the index matching that time range2. A historical search is a search that runs over a fixed period of time in the past2. When you run a historical search, Splunk searches the index for events that match your search string and fall within the specified time range2. Therefore, option B is correct, while options A and C are incorrect because they are not what the time range defines for a historical search.

• Question 29:

  If a search returns ____________ it can be viewed as a chart.

  A. timestamps

  B. statistics

  C. events

  D. keywords

  Correct Answer: B

  If a search returns statistics, it can be viewed as a chart2. Statistics are tabular data that show the relationship between two or more fields2. You can create statistics by using commands such as stats, chart or timechart2. You can view statistics as a chart by selecting the Visualization tab in the Search app and choosing a chart type such as column, line or pie2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of data that can be viewed as a chart.

• Question 30:

  Which of the following statements describes the use of the Field Extractor (FX)?

  A. The Field Extractor automatically extracts all fields at search time.

  B. The Field Extractor uses PERL to extract fields from the raw events.

  C. Fields extracted using the Field Extractor persist as knowledge objects.

  D. Fields extracted using the Field Extractor do not persist and must be defined for each search.

  Correct Answer: C

  The statement that fields extracted using the Field Extractor persist as knowledge objects is true. The Field Extractor (FX) is a graphical tool that allows you to extract fields from raw events using regular expressions or delimiters. The fields extracted by the FX are saved as knowledge objects that can be used in future searches or shared with other users.