Winter Sale Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: v4s65

SPLK-1002 Exam Dumps - Splunk Core Certified Power User Exam

Go to page:
Question # 81

Which of the following commands support the same set of functions?

A.

stats, eval, table

B.

search, where, eval

C.

stats, chart, timechart

D.

transaction, chart, timechart

Full Access
Question # 82

What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

A.

Consult the CIM data model reference tables.

B.

Run a search using the authentication command.

C.

Consult the CIM event type reference tables.

D.

Run a search using the correlation command.

Full Access
Question # 83

How is an event type created from the search window? (select all that apply)

A.

In the top right corner, click Save As > Event Type.

B.

In an event's detail dropdown, click Event Actions > Build Event Type.

C.

Edit eventtypes.conf and add a new stanza.

D.

Add | eventtype to the SPL and execute the search.

Full Access
Question # 84

Consider the following search:

index=web sourcetype=access_combined

The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group.

From the following list, which search groups events by JSESSIONID?

A.

index=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117

B.

index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117

C.

index=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID

D.

index=web sourcetype=access_combined JSESSIONID

Full Access
Question # 85

In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

A.

The description field would contain no value.

B.

The description field would contain the value 0.

C.

The description field would contain the value "Internal Server Error".

D.

This statement would produce an error in Splunk because it is incomplete.

Full Access
Question # 86

Which of the following expressions could be used to create a calculated field called gigabytes?

A.

eval sc_bytes(1024/1024)

B.

| eval negabytes=sc_bytes(1024/1024)

C.

megabytes=sc_bytes(1024/1024)

D.

sc_bytas(1024/1024)

Full Access
Go to page: