Splunk Splunk Certifications SPLK-1002 Questions & Answers

• Question 31:

  When using the transaction command, how are evicted transactions identified?

  A. Closed_txn field is set to o, or false.

  B. Max_txn field is set to O, or false.

  C. Txn_field is set to 1, or true.

  D. open_txn field is set to 1, or true.

  Correct Answer: A

  The transaction command is a Splunk command that finds transactions based on events that meet various constraints1.

  Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member1.

  The transaction command adds some fields to the raw events that are part of the transaction12. These fields are:

  Therefore, evicted transactions can be distinguished from non-evicted transactions by checking the value of the closed_txn field. The closed_txn field is set to 0, or false, for evicted transactions and 1, or true for non-evicted, or closed,

  transactions23.

• Question 32:

  Which of the following commands will show the maximum bytes?

  A. sourcetype=access_* | maximum totals by bytes

  B. sourcetype=access_* | avg (bytes)

  C. sourcetype=access_* | stats max(bytes)

  D. sourcetype=access_* | max(bytes)

  Correct Answer: C

• Question 33:

  Using the export function, you can export search results as __________.( Select all that apply)

  A. Xml

  B. Json

  C. Html

  D. A php file

  Correct Answer: AB

  Using the export function, you can export search results as XML or JSON2. The export function allows you to save your search results in a structured format that can be used by other applications or tools2. You can use the output_mode parameter to specify whether you want to export your results as XML or JSON2. Therefore, options A and B are correct, while options C and D are incorrect because they are not formats that you can export your search results as.

• Question 34:

  What is a limitation of searches generated by workflow actions?

  A. Searches generated by workflow action cannot use macros.

  B. Searches generated by workflow actions must be less than 256 characters long.

  C. Searches generated by workflow action must run in the same app as the workflow action.

  D. Searches generated by workflow action run with the same permissions as the user running them.

  Correct Answer: D

• Question 35:

  Which syntax is used to represent an argument in a macro definition?

  A. "argument"

  B. %argument%

  C. `argument'

  D. $argument$

  Correct Answer: D

  The correct answer is D.

  A search macro is a way to reuse a piece of SPL code in different searches. A search macro can take arguments, which are variables that can be replaced by different values when the macro is called. A search macro can also contain

  another search macro within it, which is called a nested macro1.

  To represent an argument in a macro definition, you need to use the dollar sign ($) character to enclose the argument name. For example, if you want to create a search macro that takes one argument named "object", you can use the

  following syntax:

  [my_macro(object)] search sourcetype= object

  This will create a search macro named my_macro that takes one argument named object. When you call the macro in a search, you need to provide a value for the object argument, such as:

  my_macro(web)

  This will replace the object argument with the value web and run the following SPL code:

  search sourcetype=web

  The other options are not correct because they use quotation marks (' or ") or percentage signs (%) to represent arguments, which are not valid syntax for macro arguments. These characters will be interpreted as literal values instead of

  variables.

  References:

  Use search macros in searches

• Question 36:

  Which of the following statements would help a user choose between the transaction and stats commands?

  A. state can only group events using IP addresses.

  B. The transaction command is faster and more efficient.

  C. There is a 1000 event limitation with the transaction command.

  D. Use state when the events need to be viewed as a single event.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Transaction

  One of the statements that would help a user choose between the transaction and stats commands is that there is a 1000 event limitation with the transaction command3.

  The transaction command is used to group events that share a common value for one or more fields into transactions3. The transaction command has a default limit of 1000 events per transaction, which means that it will not group more than 1000 events into a single transaction3. This limit can be changed by using the maxevents parameter, but it can affect the performance and memory usage of Splunk3. Therefore, option C is correct, while options A, B and D are incorrect because they are not statements that would help a user choose between the transaction and stats commands.

• Question 37:

  Given the following eval statement:

  ...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull, "NO-VALUE", fieid2)

  Which of the following is the equivalent using f ilinull?

  A. There is no equivalent expression using f ilinull

  B. ... t filinull values=(0,"NO-VALUE") fields=(fieldl,field2)

  C. ... I filinull value=0 fieldl I fillnull fields

  D. ... I fillnull fieldl I filinull value="NO-VALUE" field2

  Correct Answer: B

  The fillnull command replaces null values in one or more fields with a specified value. The values option allows you to specify a comma-separated list of values to fill the null values in the corresponding fields. The fields option allows you to specify a comma-separated list of fields to apply the fillnull command to. The eval statement in the question uses the if and isnull functions to check if field1 and field2 have null values and replace them with 0 and "NO-VALUE" respectively. The equivalent expression using fillnull is to use the values option to specify 0 and "NO-VALUE" and the fields option to specify field1 and field22

  1: Splunk Core Certified Power User Track, page 9. 2: Splunk Documentation, fillnull command.

• Question 38:

  How is a macro referenced in a search?

  A. By using the macroname command.

  B. By using the macro command.

  C. By enclosing the macro name in backtick characters (`).

  D. By enclosing the macro name in single-quote characters (`).

  Correct Answer: C

  The correct answer is C. By enclosing the macro name in backtick characters (`).

  A macro is a way to reuse a piece of SPL code in different searches. A macro can take arguments, which are variables that can be replaced by different values when the macro is called. A macro can also contain another macro within it,

  which is called a nested macro1. To reference a macro in a search, you need to enclose the macro name in backtick characters (). For example, if you have a macro named my_macro` that takes one argument, you can reference it in a

  search by using the following syntax:

  | my_macro(argument) | ...

  This will replace the macro name and argument with the SPL code contained in the macro definition. For example, if the macro definition is:

  [my_macro(argument)] search sourcetype=$argument$ And you reference it in a search with:

  index=main | my_macro(web) | stats count by host

  This will expand the macro and run the following SPL code:

  index=main | search sourcetype=web | stats count by host References:

  Use search macros in searches

• Question 39:

  Which of the following transforming commands can be used with transactions?

  A. chart, timechart, stats, eventstats

  B. chart, timechart, stats, diff

  C. chart, timeehart, datamodel, pivot

  D. chart, timecha:t, stats, pivot

  Correct Answer: A

  The correct answer is A. chart, timechart, stats, eventstats.

  Transforming commands are commands that change the format of the search results into a table or a chart. They can be used to perform statistical calculations, create visualizations, or manipulate data in various ways1. Transactions are groups of events that share some common values and are related in some way. Transactions can be defined by using the transaction command or by creating a transaction type in the transactiontypes.conf file2. Some transforming commands can be used with transactions to create tables or charts based on the transaction fields. These commands include: chart: This command creates a table or a chart that shows the relationship between two or more fields. It can be used to aggregate values, count occurrences, or calculate statistics3. timechart: This command creates a table or a chart that shows how a field changes over time. It can be used to plot trends, patterns, or outliers4. stats: This command calculates summary statistics on the fields in the search results, such as count, sum, average, etc. It can be used to group and aggregate data by one or more fields5. eventstats: This command calculates summary statistics on the fields in the search results, similar to stats, but it also adds the results to each event as new fields. It can be used to compare events with the overall statistics. These commands can be applied to transactions by using the transaction fields as arguments. For example, if you have a transaction type named "login" that groups events based on the user field and has fields such as duration and eventcount, you can use the following commands with transactions: | chart count by user : This command creates a table or a chart that shows how many transactions each user has. | timechart span=1h avg(duration) by user : This command creates a table or a chart that shows the average duration of transactions for each user per hour. | stats sum(eventcount) as total_events by user : This command creates a table that shows the total number of events for each user across all transactions. | eventstats avg(duration) as avg_duration : This command adds a new field named avg_duration to each transaction that shows the average duration of all transactions. The other options are not valid because they include commands that are not transforming commands or cannot be used with transactions. These commands are: diff: This command compares two search results and shows the differences between them. It is not a transforming command and it does not work with transactions. datamodel: This command retrieves data from a data model, which is a way to organize and categorize data in Splunk. It is not a transforming command and it does not work with transactions. pivot: This command creates a pivot report, which is a way to analyze data from a data model using a graphical interface. It is not a transforming command and it does not work with transactions. References: About transforming commands About transactions chart command overview timechart command overview stats command overview [eventstats command overview] [diff command overview] [datamodel command overview] [pivot command overview]

• Question 40:

  Which of the following statements describes POST workflow actions?

  A. Configuration of a POST workflow action includes choosing a sourcetype.

  B. POST workflow actions can be configured to send email to the URI location.

  C. By default, POST workflow action are shown in both the event and field menus.

  D. POST workflow actions can be configured to send POST arguments to the URI location.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/SetupaPOSTworkflowacti on