Splunk Core Certified Power User Exam (SPLK-1002) Free Practice Test

Question 1

When using multiple expressions in a single eval command, which delimiter is used?

A. / (forward slash)

B. : (colon)

C. I (pipe)

D. , (comma)

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

A. The rename command.

B. Macros.

C. CIM does not work with different names for the same field.

D. Field aliases.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Which of the following statements about tags is true?

A. Tags are searched by using the syntax tag: : < fieldneme >

B. Tags are created at index time.

C. Tags are case insensitive.

D. Tags can make your data more understandable.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

The Common Information Model (CIM) Add-on contains a collection of what preconfigured knowledge objects?

A. Field extractions

B. Reports

C. Dashboards

D. Data models

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Which of the following is true about a datamodel that has been accelerated?

A. They can be used with Pivot, the | tstats command, or the | datamodel command.

B. They can still be used in the Pivot tool but only with the accelerate_pivot capability.

C. They can no longer be used in the Pivot tool.

D. They can be used with the |tstats command, but will only return that data which has been accelerated.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

A. Determined automatically based on the sourcetype.

B. Turned on

C. Determined automatically based on the data source.

D. Turned off

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

What are the expected results for a search that contains the command | where A=B?

A. Events that contain the string value where A=B.

B. Events where values of field are equal to values of field B.

C. Events that contain the string value A=B.

D. Events where field A contains the string value B.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

A. Authorization

B. Accounting

C. Access

D. Authentication

Correct Answer: D

Question 9

Which of these is NOT a field that is automatically created with the transaction command?

A. duration

B. maxcount

C. eventcount

Correct Answer: B

Question 10

What are the two parts of a root event dataset?

A. Constraints and fields.

B. Fields and variables.

C. Fields and attributes.

D. Constraints and lookups.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 11

Consider the the following search run over a time range of last 7 days:
index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane Which option is used to change the default time span so that results are grouped into 12 hour intervals?

A. span=12h

B. span=12

C. timespan=12h

D. timespan=12

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

The stats command will create a _____________ by default.

A. Pie chart

B. Table

C. Report

Correct Answer: B

Question 13

Which of the following is true about data sets used in the Pivot tool?

A. They can only be created from saved reports.

B. They can only be created by users with the Admin role.

C. They can only be created from data models.

D. They can only be created from summary indexes.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 14

A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

A. all of the above

B. deleted

C. skipped or deferred

D. automatically accelerated

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Splunk Core Certified Power User (SPLK-1002) Free Practice Test