Free Splunk Core Certified Advanced Power User Exam SPLK-1004 Exam Practice Test

Assuming a standard time zone across the environment, what syntax will always return events from between 2:00 AM and 5:00 AM?

• datehour>-2 AND date_hour<5
• earliest=-2h@h AND latest=-5h@h
• time_hour>-2 AND time_hour>-5
• earliest=2h@ AND latest=5h3h

What order of incoming events must be supplied to the transaction command to ensure correct results?

• Reverse lexicographical order
• Ascending lexicographical order
• Ascending chronological order
• Reverse chronological order

Which of the following is accurate about cascading inputs?

• They can be reset by an event handler.
• The final input has no impact on previous inputs.
• Only the final input of the sequence can supply a token to searches.
• Inputs added to panels cannot participate.

Which is a regex best practice?

• Use complex expressions rather than simple ones.
• Avoid backtracking.
• Use greedy operators (.*) instead of non-greedy operators (.*?).
• Use * rather than +.

What does the query | makeresults generate?

• A timestamp
• A results field
• An error message
• The results of the previously run search

When using a nested search macro, how can an argument value be passed to the inner macro?

• The argument value may be passed to the outer macro.
• An argument cannot be used with an inner nested macro.
• An argument cannot be used with an outer nested macro.
• The argument value must be specified in the outer macro.

Why use the tstats command?

• As an alternative to the summary command.
• To generate statistics on indexed fields.
• To generate an accelerated data model.
• To generate statistics on search-time fields.

What file types does Splunk use to define geospatial lookups?

• GPX or GML files
• TXT files
• KMZ or KML files
• CSV files

Which function of the stats command creates a multivalue entry?

• mvcombine
• eval
• makemv
• list

Which of the following would exclude all entries contained in the lookup file baditems.csv from search results?

• NOT [inputlookup baditems.csv]
• NOT (lookup baditems.csv OUTPUT item)
• WHERE item NOT IN (baditems.csv)
• [NOT inputlookup baditems.csv]