splk-1002 mock exam 1

Which one of the following statements about the search command is true?

It is mandatory for the lookup file to have this for an automatic lookup to work.

What does the following search do? index=corndog type=mysterymeat action=eaten | stats count as cornlog_count by us:

These kinds of charts represent a series in a single bar with multiple sections.

If a search returns ____________ it can be viewed as a chart.

Which of the following statements about tags is true?

This role is required to install the CIM Add-on. Select your answer.

Which of the following eval command function is valid?

Field aliases are used to __________ data

Which of the following is the correct way to use the data model command to search fields in the Web data model within the web dataset?

When extracting fields, we may choose to use our own regular expressions

Which of the following statements describes field aliases?

Alert throttling is used to _______.

This is what Splunk uses to categorize the data that is being indexed.

Which of the following knowledge objects represents the output of an eval expression?

Which of the following actions can the eval command perform?

Which of the following statements describe data model acceleration? (select all that apply, write letter of corresponding answer/s) A. Root events cannot be accelerated. B. Accelerated data models cannot be edited. C. Private data models cannot be accelerated. D. You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.

What is the relationship between data models and pivots?

This function of the stats command allows you to return the middle-most value of field X.

Which of the following commands are used when creating visualizations(select all that apply.) A. Geom B. Choropleth C. Geostats D. Iplocation

This function of the stats command allows you to identify the number of values a field has.

Which of these search strings is NOT valid:

A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being _____.

What does the transaction command do?

Which of the following is NOT a stats function:

Data models are composed of one or more of which of the following datasets?

Which delimiters can the Field Extractor (FX) detect?

We can use the rename command to _____ (

In what order are the following knowledge objects/configurations applied?

Which is not a comparison operator in Splunk

Which of the following can be used with the eval command tostring function

Which command is used to create choropleth maps?

A calculated field maybe based on which of the following?

What do events in a transaction have in common?

What are the two parts of a root event dataset?

In which of the following scenarios is an event type more effective than a saved search?

A space is an implied _____ in a search string.

Which of the following statements describes macros?