Free Splunk Core Certified Power User Exam SPLK-1002 Exam Practice Test

The time range specified for a historical search defines the ____________ .------questionable on ans

• Amount of data shown on the timeline as data streams in
• Amount of data fetched from index matching that time range
• Time range for the static results

In the Field Extractor, when would the regular expression method be used?

• When events contain JSON data.
• When events contain comma-separated data.
• When events contain unstructured data.
• When events contain table-based data.

What is the purpose of a calculated field?

• To automatically add fields to the index using an eval expression rather than manually including an eval command.
• To manually add and remove fields at search time related to statistical functions.
• To automatically add fields at search time using an eval expression rather than manually including an eval command.
• To manually add fields at search time and check for syntax errors.

Which of the following statements describes macros?

• A macro is a reusable search string that must contain the full search.
• A macro is a reusable search string that must have a fixed time range.
• A macro Is a reusable search string that may have a flexible time range.
• A macro Is a reusable search string that must contain only a portion of the search.

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

• Access
• Accounting
• Authorization
• Authentication

For the following search, which command would further filter for only IP addresses present more than five times?

• index=games I stats count as IP_count by IP B. | where IP_count > 5
• index=games | search IP_Count > 5
• index=games | where IP > 5
• index=games I search IP > 5

What field must be present in order to use the timechart command?

• _raw
• rime
• _time
• index

Which of the following actions can the eval command perform?

• Remove fields from results.
• Create or replace an existing field.
• Group transactions by one or more fields.
• Save SPL commands to be reused in other searches.

A user wants to create a new field alias for a field that appears in two sourcetypes.How many field aliases need to be created?

• One.
• Two.
• It depends on whether the original fields have the same name.
• It depends on whether the two sourcetypes are associated with the same index.

What does the fillnull command replace null values with, if the value argument is not specified?

• 0
• N/A
• NaN
• NULL