SPLK-1002

Which of the following statements would help a user choose between the transaction and stars commands?A . stats can only group events using IP addresses.B . The transaction command is faster and more efficient.C . There is a 1000 event limitation with the transaction command.D . Use stats when the...

Which one of the following statements about the search command is true?A . It does not allow the use of wildcards.B . It treats field values in a case-sensitive manner.C . It can only be used at the beginning of the search pipeline.D . It behaves exactly like search strings...

When using the Field Extractor (FX), which of the following delimiters will work? (Choose all that apply.)A . TabsB . PipesC . ColonsD . SpacesView AnswerAnswer: BD Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep

When can a pipe follow a macro?A . A pipe may always follow a macro.B . The current user must own the macro.C . The macro must be defined in the current app.D . Only when sharing is set to global for the macro.View AnswerAnswer: A

Data models are composed of one or more of which of the following datasets? (Choose all that apply.)A . Events datasetsB . Search datasetsC . Transaction datasetsD . Any child of event, transaction, and search datasetsView AnswerAnswer: ABC Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels

Based on the macro definition shown below, what is the correct way to execute the macro in a search string? A . "convert_sales(euro,,.79)"B . 'convert_sales(euro,,.79)'C . "convert_sales($euro$,$$,$.79$)"D . 'convert_sales($euro$,$$,$.79$)'View AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros

Which of the following actions can the eval command perform?A . Remove fields from results.B . Create or replace an existing field.C . Group transactions by one or more fields.D . Save SPL commands to be reused in other searches.View AnswerAnswer: A

Which group of users would most likely use pivots?A . UsersB . ArchitectsC . AdministratorsD . Knowledge ManagersView AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Pivot/IntroductiontoPivot

Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)A . TabsB . PipesC . SpacesD . CommasView AnswerAnswer: BCD Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep

Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)A . CIM is a methodology for normalizing data.B . CIM can correlate data from different sources.C . The Knowledge Manager uses the CIM to create knowledge objects.D . CIM is an app that can coexist...