Splunk SPLK-1002 Splunk Core Certified Power User Exam Exam Practice Test Questions

• Question 1

  Which of the following searches would return a report of sales by product-name?

  • Chart sales by product_name
  • Chart sum(price) as sales by product_name
  • Stats sum(price) as sales over product_name
  • Timechart list(sales), values(product_name)

  Show Answer Answer: B Next

• Question 2

  Which are valid ways to create an event type? (select all that apply)

  • By using the searchtypes command in the search bar.
  • By editing the event_type stanza in the props.conf file.
  • By going to the Settings menu and clicking Event Types > New.
  • By selecting an event in search results and clicking Event Actions > Build Event Type.

  Show Answer Answer: C, D Next

• Question 3

  What do events in a transaction have In common?

  • All events In a transaction must have the same timestamp.
  • All events in a transaction must have the same sourcetype.
  • All events in a transaction must have the exact same set of fields.
  • All events in a transaction must be related by one or more fields.

  Show Answer Answer: D Next

• Question 4

  Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

  • Auto-Extracted fields can be hidden in Pivot.
  • Auto-Extracted fields can have their data type changed.
  • Auto-Extracted fields can be given a friendly name for use in Pivot.
  • Auto-Extracted fields can be added if they already exist in the dataset with constraints.

  Show Answer Answer: A, B, C, D Next

• Question 5

  For choropleth maps,splunk ships with the following KMZ files (select all that apply)

  • States of the United States
  • States and provinces of the united states and Canada
  • Countries of the European Union
  • Countries of the World

  Show Answer Answer: A, D Next