● Splunk Core Certified Power User (SPLK-1002) Exam Materials
● Over 2 Students Passed Splunk Core Certified Power User (SPLK-1002) Using This Dump – Join Them Today!
● Over 60 Verified Questions for Splunk Core Certified Power User Dump (SPLK-1002 Dump)
● 100% Score in the Real Splunk Core Certified Power Usert Exam (SPLK-1002 Exam) at the Pearson VUE Testing Center
● Over 60 Verified Questions for Splunk Core Certified Power User Dump (SPLK-1002 Dump)
● 100% Score in the Real Splunk Core Certified Power Usert Exam (SPLK-1002 Exam) at the Pearson VUE Testing Center
Question #1
Question #2
Which of the following is true about the Splunk Common Information Model (CIM)? (Choose one answer)
- A. The CIM contains 28 pre-configured datasets.
- B. The data models included in the CIM are configured with data model acceleration turned off.
- C. The CIM is an app that needs to run on the indexer.
- D. The data models included in the CIM are configured with data model acceleration turned on.
Question #3
Which of the following definitions describes a macro named "samplemacro" that accepts two arguments? (Choose one answer)
- A. samplemacro[1,2]
- B. samplemacro[2]
- C. samplemacro(1,2)
- D. samplemacro(2)
Question #4
What is the correct syntax to find events associated with a tag? (Choose one answer)
- A. tags=<value>
- B. tag:<field>=<value>
- C. tag=<value>
- D. tags:<field>=<value>
Question #5
Which of the following statements describe the search string below?
I datamodel Application_State All_Application_State search
(Choose one answer)
- A. Events will be returned from dataset named Application_State.
- B. Events will be returned from the data model named All_Application_State.
- C. Events will be returned from the data model named Application_State.
- D. No events will be returned because the pipe should occur after the datamodel command.
Question #6
What is the correct format for naming a macro with multiple arguments? (Choose one answer)
- A. monthly_sales[3]
- B. monthly_sales(argument 1, argument 2, argument 3)
- C. monthly_sales[argument 1, argument 2, argument 3]
- D. monthly_sales(3)
Question #7
What are the two parts of a root event dataset? (Choose one answer)
- A. Constraints and lookups.
- B. Constraints and fields.
- C. Fields and variables.
- D. Fields and attributes.
Question #8
Which option of the transaction command would be used to specify the maximum time between events in a transaction? (Choose one answer)
- A. duration
- B. maxspan
- C. eventcount
- D. maxpause
Question #9
What is the correct Boolean order of evaluation for the where command from first to last? (Choose one answer)
- A. Parentheses, NOT, AND, OR
- B. AND, Parentheses, NOT, OR
- C. Parentheses, NOT, OR, AND
- D. NOT, Parentheses, OR, AND
Question #10
Given the following eval statement:
... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2)
Which of the following is the equivalent using fillnull?
(Choose one answer)
- A. ... | fillnull value=0 field1 | fillnull field2
- B. ... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)
- C. There is no equivalent expression using fillnull
- D. ... | fillnull field1 | fillnull value="NO-VALUE" field2
When does the CIM add-on apply preconfigured data models to the data? (Choose one answer)