最新的Splunk Core Certified Power User - SPLK-1002免費考試真題

A. Calculated fields can only be used in dashboards.

B. Calculated fields can only be used in saved reports.

C. Calculated fields cannot be chained together to create more complex fields

D. Calculated fields can be chained together to create more complex fields.

A. index-server_472 sourcetype-BETA_494 code-488 I stats count by code

B. index=server_472 sourcetype=BETA_494 code=488 [I inputlookup append=t servercode.csv]

C. index=server_472 sourcetype=BETA_494 code=488 I stats where code > 200

D. index=server_472 sourcetype=BETA_494 code-488

A. The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

B. The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

C. The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

D. The macro name is sessiontracker and the arguments are action, JESSIONID.

A. stdev

B. by standarddev

C. count deviation

D. dev

A. skipped or deferred

B. all of the above

C. automatically accelerated

D. deleted

A. Users cannot create visualizations with Pivot.

B. Users must use SPL to find events in a Pivot.

C. Users cannot share visualizations created with Pivot.

D. Users can save reports from Pivot.

A. Use state when the events need to be viewed as a single event.

B. There is a 1000 event limitation with the transaction command.

C. The transaction command is faster and more efficient.

D. state can only group events using IP addresses.

A. samplemacro[1,2]

B. samplemacro(2)

C. samplemacro(1,2)

D. samplemacro[2]

A. index=web | stats sum(bytes) BY values (page) values (server)

B. index=web | stats sum (bytes) BY page BY server

C. index=web | stats sum(bytes) BY page AND server

D. index=web | stats sum (bytes) BY page server

A. Root child dataset

B. Root event dataset

C. Root search dataset

D. Root transaction dataset

A. Definition and arguments.

B. Name and definition.

C. Name and a validation error message.

D. Name and arguments.

A. It does not allow the use of wildcards.

B. It behaves exactly like search strings before the first pipe.

C. It treats field values in a case-sensitive manner.

D. It can only be used at the beginning of the search pipeline.

A. deselect

B. selecting a bar on the timeline

C. zoom out

D. selecting a range of bars on the timelines

A. Lookup tables

B. Extracted fields

C. Regular expressions

D. Fields generated within a search string

A. When a log file has values that are separated by the same character, for example, commas.

B. When a log file contains empty lines or comments.

C. With structured files such as JSON or XML.

D. When the file has a header that might provide information about its structure or format.