最新的Splunk SPLK-1002免費考試真題

問題1

What do events in a transaction have In common?

A. All events in a transaction must be related by one or more fields.

B. All events in a transaction must have the exact same set of fields.

C. All events in a transaction must have the same sourcetype.

D. All events In a transaction must have the same timestamp.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題2

Which of the following actions can the eval command perform?

A. Save SPL commands to be reused in other searches.

B. Remove fields from results.

C. Create or replace an existing field.

D. Group transactions by one or more fields.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題3

A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

A. It depends on whether the two sourcetypes are associated with the same index.

B. Two.

C. One.

D. It depends on whether the original fields have the same name.

正確答案: B

問題4

A macro has another macro nested within it, and this inner macro requires an argument. How can the user pass this argument into the SPL?

A. An argument can be passed to the inner macro by nesting parentheses.

B. There is no way to pass an argument to the inner macro.

C. An argument can be passed to the outer macro by nesting parentheses.

D. An argument can be passed through the outer macro.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題5

Which one of the following statements about the search command is true?

A. It does not allow the use of wildcards.

B. It can only be used at the beginning of the search pipeline.

C. It treats field values in a case-sensitive manner.

D. It behaves exactly like search strings before the first pipe.

正確答案: D

說明：（僅 Fast2test 成員可見）

問題6

The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

A. The extraction is private-

B. The dashboard is private.

C. Fast mode is enabled.

D. The person in the organization running the report does not have access to the index.

正確答案: A,D

說明：（僅 Fast2test 成員可見）

問題7

The macro weekly_sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?

A. 'weekly sales (3.99, 10)'

B. 'weekly_sales (3.99, 10)'

C. 'weekly_sales($3.995, $108)'

D. 'weekly sales (3)'

正確答案: B

說明：（僅 Fast2test 成員可見）

問題8

Which of the following describes the Splunk Common Information Model (CIM) add-on?

A. The CIM add-on contains dashboards that show how to map data.

B. The CIM add-on is automatically installed in a Splunk environment.

C. The CIM add-on uses machine learning to normalize data.

D. The CIM add-on contains data models to help you normalize data.

正確答案: D

說明：（僅 Fast2test 成員可見）

問題9

What fields does the transaction command add to the raw events? (select all that apply)

A. eventcount

B. count

C. duration

D. transaction id

正確答案: C,D

說明：（僅 Fast2test 成員可見）

問題10

These allow you to categorize events based on search terms.
Select your answer.

A. Tags

B. Macros

C. Event Types

D. Groups

正確答案: C

問題11

Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

A. The Knowledge Manager uses the CIM to create knowledge objects.

B. CIM can correlate data from different sources.

C. CIM is an app that can coexist with other apps on a single Splunk deployment.

D. CIM is a methodology for normalizing data.

正確答案: A,B,D

說明：（僅 Fast2test 成員可見）

問題12

Which of the following statements about event types is true? (select all that apply)

A. Event types must include a time range,

B. Event types categorize events based on a search.

C. Event types can be a useful method for capturing and sharing knowledge.

D. Event types can be tagged.

正確答案: B,C,D

說明：（僅 Fast2test 成員可見）

問題13

When using the timechart command, how can a user group the events into buckets based on time?

A. Adjusting the fieldformat options.

B. Using the duration argument.

C. Using the interval argument.

D. Using the span argument.

正確答案: D

問題14

The time range specified for a historical search defines the ____________ .------questionable on ans

A. Time range for the static results

B. Amount of data shown on the timeline as data streams in

C. Amount of data fetched from index matching that time range

正確答案: C

說明：（僅 Fast2test 成員可見）

最新的Splunk Core Certified Power User - SPLK-1002免費考試真題

聯系我們

站內鏈接

最新更新