最新的Splunk Core Certified Power User - SPLK-1002免費考試真題

A. By using the macro command.

B. By using the macroname command.

C. By enclosing the macro name in backtick characters (').

D. By enclosing the macro name in single-quote characters (').

A. Calculated fields and tags only.

B. Calculated fields, lookups, event types, and tags.

C. Calculated fields and event types only.

D. Calculated fields, lookups, event types, and extracted fields.

A. Save SPL commands to be reused in other searches.

B. Remove fields from results.

C. Create or replace an existing field.

D. Group transactions by one or more fields.

A. Multiple indexes

B. Data model dataset name.

C. status field

D. Data model field name.

A. Sub-Search

B. POST

C. Search

D. Action

A. Events will be returned from the data model named Application_State.

B. Evenrches would return a report of sales by state.

C. Events will be returned from the data model named All_Application_state.

D. No events will be returned because the pipe should occur after the datamodel command

A. Calculated fields can be used in the search bar.

B. Calculated fields are shortcuts for performing calculations using the eval command.

C. Calculated fields can only be applied to host and sourcetype.

D. Calculated fields can be based on an extracted field.

A. monthly_sales(3)

B. monthly_sales[3]

C. monthly_sales[argument 1, argument 2, argument 3)

D. monthly_sales(argument 1, argument 2, argument 3)

A. It must contain the transaction command if it is a root transaction dataset.

B. It can contain transforming commands as long as it is a root search dataset.

C. It will automatically contain knowledge objects associated with the base search.

D. It can only contain a base search with no transforming commands.

A. It does not allow the use of wildcards.

B. It can only be used at the beginning of the search pipeline.

C. It treats field values in a case-sensitive manner.

D. It behaves exactly like search strings before the first pipe.