SPLK-1002 Exam Info and Free Practice Test Professional Quiz Study Materials [Q43-Q62]

QUESTION 43
Which of the following searches show a valid use of a macro? (Choose all that apply.) index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time

QUESTION 44
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

QUESTION 45
After manually editing; a regular expression (regex), which of the following statements is true?

QUESTION 46
These kinds of fields are identified in you data at INDEX time.

QUESTION 47
Which of the following searches show a valid use of macro? (Select all that apply)

QUESTION 48
Which of the following statements describes calculated fields?

QUESTION 49
What does the transaction command do?

QUESTION 50
Which of the following search control will not re-rerun the search? (Select all that apply.)

QUESTION 51
When should you use the transactioncommand instead of the stats command?

QUESTION 52
A calculated field maybe based on which of the following?

QUESTION 53
Which of the following searches would create a graph similar to the one below?

QUESTION 54
Which of the following workflow actions can be executed from search results? (select all that apply)

QUESTION 55
Information needed to create a GET workflow action includes which of the following? (select all that apply.)

QUESTION 56
Which of the following statements describes the use of the Field Extractor (FX)?

QUESTION 57
When using timechart, how many fields can be listed after a by clause?

QUESTION 58
Which of the following is NOT a stats function:

QUESTION 59
When creating a Search workflow action, which field is required?

QUESTION 60
When defining a macro, what are the required elements?

QUESTION 61
Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM)
Add-on documented?

QUESTION 62
A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.