SPLK-1002 Exam Dumps - Splunk Core Certified Power User Exam

The correct answer is B. A field added by an automatic lookup.

A calculated field is a field that is added to events at search time by using an eval expression. A calculated field can use the values of two or more fields that are already present in the events to perform calculations. A calculated field can use any field as a source, as long as the field is extracted before the calculated field is defined1.

An automatic lookup is a way to enrich events with additional fields from an external source, such as a CSV file or a database. An automatic lookup can add fields to events based on the values of existing fields, such as host, source, sourcetype, or any other extracted field2. An automatic lookup is performed before the calculated fields are defined, so the fields added by the lookup can be used as sources for the calculated fields3.

Therefore, a calculated field can use a field added by an automatic lookup as a source.

Data model acceleration is a feature that speeds up searches on data models by creating and storing summaries of the data model datasets1. To enable data model acceleration, you must have administrative permissions or the accelerate_datamodel capability1. Therefore, option D is correct. Accelerated data models cannot be edited unless you disable the acceleration first1. Therefore, option B is correct. Private data models cannot be accelerated because they are not visible to other users1. Therefore, option C is correct. Root events can be accelerated as long as they are not based on a search string1. Therefore, option A is incorrect.

 The following search would create a graph similar to the one below:

index_internal sourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status

The search does the following:

It uses index_internal to specify the internal index that contains Splunk logs and metrics.

It uses sourcetype=Savesplunker to filter events by the sourcetype that indicates the Splunk Enterprise Security app.

It uses fields sourcetype, status to keep only the sourcetype and status fields in the events.

It uses transaction status maxspan=1d to group events into transactions based on the status field with a maximum time span of one day between the first and last events in a transaction.

It uses timechart count by status to create a time-based chart that shows the count of transactions for each status value over time.

The graph shows the following:

It is a line graph with two lines, one yellow and one blue.

The x-axis is labeled with dates from Wed, Apr 4, 2018 to Tue, Apr 10, 2018.

The y-axis is labeled with numbers from 0 to 15.

The yellow line represents “shipped” and the blue line represents “success”.

The yellow line has a steady increase from 0 to 15, while the blue line has a sharp increase from 0 to 5, then a decrease to 0, and then a sharp increase to 10.

The graph is titled “Type”.

Therefore, option C is the correct answer.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Abouttransactions

In other cases, it's usually better to use the stats command, which performs more efficiently, especially in a distributed environment. Often there is a unique ID in the events and stats can be used.

Field aliases are used to normalize different field names that contain the same type of data (like IP addresses) across multiple sourcetypes or sources, making the data CIM compliant without re-extracting the fields.