What Pinpoint SPLK-1002 Exam Guide Is

NEW QUESTION 1

Which of the following searches will show the number of categoryld used by each host?

• A. Sourcetype=access_* |sum bytes by host
• B. Sourcetype=access_* |stats sum(categoryl
• C. by host
• D. Sourcetype=access_* |sum(bytes) by host
• E. Sourcetype=access_* |stats sum by host

Answer: B

NEW QUESTION 2

When using the transaction command, what does the argument maxspan do?

• A. Sets the maximum total time between events in a transaction.
• B. Sets the maximum length of all events within a transaction.
• C. Sets the maximum total time between the earliest and latest events in a transaction.
• D. Sets the maximum length that any single event can reach to be included in the transaction.

Answer: B

NEW QUESTION 3

Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

• A. Events in the transaction occurred within 5 seconds.
• B. It groups events that share the same clientip and host.
• C. The first and last events are no more than 5 seconds apart.
• D. The first and last events are no more than 30 seconds apart.

Answer: B

NEW QUESTION 4

Which of the following statements describe data model acceleration? (select all that apply)

• A. Root events cannot be accelerated.
• B. Accelerated data models cannot be edited.
• C. Private data models cannot be accelerated.
• D. You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.

Answer: BCD

NEW QUESTION 5

Calculated fields can be based on which of the following?

• A. Tags
• B. Extracted fields
• C. Output fields for a lookup
• D. Fields generated from a search string

Answer: B

NEW QUESTION 6

Which of the following statements describes the use of the Filed Extractor (FX)?

• A. The Field Extractor automatically extracts all field at search time.
• B. The Field Extractor uses PERL to extract field from the raw events.
• C. Field extracted using the Extracted persist as knowledge objects.
• D. Fields extracted using the Field Extractor do not persist and must be defined for each search.

Answer: C

NEW QUESTION 7

Which of the following statements describe the search string below?
dacamodel Application_State All_Application_State search

• A. Events will be returned from dataset named Application_state.
• B. Events will be returned from the data model named Application_State.
• C. Events will be returned from the data model named All_Application_state.
• D. No events will be returned because the pipe should occur after the datamodel command

Answer: C

NEW QUESTION 8

Which of the following statements describes macros?

• A. A macro is a reusable search string that must contain the full search.
• B. A macro is a reusable search string that must have a fixed time range.
• C. A macro Is a reusable search string that may have a flexible time range.
• D. A macro Is a reusable search string that must contain only a portion of the search.

Answer: C

NEW QUESTION 9

Which of the following workflow actions can be executed from search results? (select all that apply)

• A. GET
• B. POST
• C. LOOKUP
• D. Search

Answer: ABD

NEW QUESTION 10

Which of the following statements describes POST workflow actions?

• A. POST workflow actions are always encrypted.
• B. POST workflow actions cannot use field values in their URI.
• C. POST workflow actions cannot be created on custom sourcetypes.
• D. POST workflow actions can open a web page in either the same window or a new .

Answer: D

NEW QUESTION 11

Splunk alerts can be based on search that run _______. (Select all that apply.)

• A. in real-time
• B. on a regular schedule
• C. and have no matching events

Answer: AB

NEW QUESTION 12

Which group of users would most likely use pivots?

• A. Users
• B. Architects
• C. Administrators
• D. Knowledge Managers

Answer: D

NEW QUESTION 13

which of the following are valid options with the chart command

• A. useother
• B. usenull
• C. fillfield
• D. usefiled

Answer: AB

NEW QUESTION 14

We can use the rename command to ______ (Select all that apply.)

• A. Change indexed fields
• B. Exclude fields from our search results
• C. Extract new fields from our data using regular expressions
• D. Give a field a new name at search time

Answer: D

NEW QUESTION 15

The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

• A. Fast mode is enabled.
• B. The dashboard is private.
• C. The extraction is private
• D. The person in the organization running the report does not have access to the index.

Answer: BD

NEW QUESTION 16

Data model are composed of one or more of which of the fo-owing datasets? (select all that apply.)

• A. Events datasets
• B. Search datasets
• C. Transaction datasets
• D. Any child of event, transaction, and search datasets

Answer: ABC

NEW QUESTION 17

In which of the following scenarios is an event type more effective than a saved search?

• A. When a search should always include the same time range.
• B. When a search needs to be added to other users' dashboards.
• C. When the search string needs to be used in future searches.
• D. When formatting needs to be included with the search string.

Answer: D

NEW QUESTION 18

Which are valid ways to create an event type? (select all that apply)

• A. By using the searchtypes command in the search bar.
• B. By editing the event_type stanza in the props.conf file.
• C. By going to the Settings menu and clicking Event Types > New.
• D. By selecting an event in search results and clicking Event Actions > Build Event Type.

Answer: CD

NEW QUESTION 19

These users can create global knowledge objects. (Select all that apply.)

• A. users
• B. power users
• C. administrators

Answer: BC

NEW QUESTION 20

A calculated field maybe based on which of the following?

• A. Lookup tables
• B. Extracted fields
• C. Regular expressions
• D. Fields generated within a search string

Answer: B

NEW QUESTION 21

Which of the following search modes automatically returns all extracted fields in the fields sidebar?

• A. Fast
• B. Smart
• C. Verbose

Answer: C

NEW QUESTION 22

Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

• A. Auto-Extracted fields can be hidden in Pivot.
• B. Auto-Extracted fields can have their data type changed.
• C. Auto-Extracted fields can be given a friendly name for use in Pivot.
• D. Auto-Extracted fields can be added if they already exist in the dataset with constraints.

Answer: B

NEW QUESTION 23

After manually editing; a regular expression (regex), which of the following statements is true?

• A. Changes made manually can be reverted in the Field Extractor (FX) UI.
• B. It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.
• C. It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.
• D. The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that wasmanually edited.

Answer: D

NEW QUESTION 24
......