Free Splunk Core Certified Power User Exam SPLK-1002 Exam Practice Test

A data model consists of which three types of datasets?

• Constraint, field, value.
• Events, searches, transactions.
• Field extraction, regex, delimited.
• Transaction, session ID, metadata.

Which of the following can be saved as an event type?

• index=server_48 sourcetype=BETA_881 code=220
• index=server_48 sourcetype=BETA_881 code=220 | stats count by code
• index=server_48 sourcetype=BETA_881 code=220 | inputlookup append=t servercode.csv
• index=server_48 sourcetype=BETA_881 code=220 | stats where code > 220

Which of the following is included with the Splunk Common Information Model (CIM) Add-on?

• Sourcetype definitions from the most popular technology vendors.
• A set of pre-configured data models.
• Scripted inputs to pre-align data with the CIM.
• Dashboards to validate data quality.

Which of the following statements about tags is true?

• Tags are case insensitive.
• Tags can make your data more understandable.
• Tags are created at index time.
• Tags are searched by using the syntax tag :: .

What happens to the original field name when a field alias is created?

• The original field name is not affected by the creation of a field alias.
• The original field name is replaced by the field alias within the index.
• The original field name is italicized to indicate that it is not an alias.
• The original field name still exists in the index but is not visible to the user at search time.

When using the transaction command, how are evicted transactions identified?

• Closed_txn field is set to o, or false.
• Max_txn field is set to O, or false.
• Txn_field is set to 1, or true.
• open_txn field is set to 1, or true.

Which of the following is true about Pivot?

• Users can save reports from Pivot.
• Users cannot share visualizations created with Pivot.
• Users must use SPL to find events in a Pivot.
• Users cannot create visualizations with Pivot.

Which of the following statements about tags is true? (select all that apply.)

• Tags are case-insensitive.
• Tags are based on field/vale pairs.
• Tags categorize events based on a search.
• Tags are designed to make data more understandable.

Selected fields are displayed ______each event in the search results.

• below
• interesting fields
• other fields
• above

This function of the stats command allows you to return the middle-most value of field X.

• Median(X)
• Eval by X
• Fields(X)
• Values(X)