最新的Splunk SPLK-1002免費考試真題

問題1

Which of the following searches show a valid use of a macro? (Choose all that apply.)

A. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

B. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

C. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

D. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField

正確答案: A,C

說明：（僅 Fast2test 成員可見）

問題2

Which statement is true?

A. Pivot is used for creating reports and dashboards.

B. Data models are randomly structured datasets.

C. Pivot is used for creating datasets.

D. In most cases, each Splunk user will create their own data model.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題3

When using the transaction command, how are evicted transactions identified?

A. Closed_txn field is set to o, or false.

B. Txn_field is set to 1, or true.

C. Max_txn field is set to O, or false.

D. open_txn field is set to 1, or true.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題4

The fields sidebar does not show________. (Select all that apply.)

A. selected fields

B. all extracted fields

C. interesting fields

正確答案: B

說明：（僅 Fast2test 成員可見）

問題5

Which of the following describes the transaction command?

A. It is an SPL command that groups events together with shared values in selected fields.

B. It allows an exchange of data from one Splunk index to another Splunk index.

C. It allows an exchange of data from one Splunk system to another Splunk system.

D. It is an SPL command that groups at least two events together based on shared values in selected fields.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題6

Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

A. The first and last events are no more than 30 seconds apart.

B. It groups events that share the same clientip and host.

C. The first and last events are no more than 5 seconds apart.

D. Events in the transaction occurred within 5 seconds.

正確答案: A,B,D

說明：（僅 Fast2test 成員可見）

問題7

Splunk alerts can be based on search that run______. (Select all that apply.)

A. in real-time

B. on a regular schedule

C. and have no matching events

正確答案: A,B

說明：（僅 Fast2test 成員可見）

問題8

When a search is executed, what must occur before field aliases can be assigned?

A. Extract fields

B. Process calculated fields

C. Create event types

D. Perform lookups

正確答案: A

說明：（僅 Fast2test 成員可見）

問題9

Which of the following statements about tags is true?

A. Tags are created at index time.

B. Tags can make your data more understandable.

C. Tags are case insensitive.

D. Tags are searched by using the syntax tag: : < fieldneme >

正確答案: B

說明：（僅 Fast2test 成員可見）

問題10

This clause is used to group the output of a stats command by a specific name.

A. Rex

B. List

C. As

D. By

正確答案: C

最新的Splunk Core Certified Power User - SPLK-1002免費考試真題

聯系我們

站內鏈接

最新更新