Splunk Core Certified Power User SPLK-1002 Reddit Questions

Splunk Core Certified Power User Exam Questions and Answers

Question 41

Which of the following statements best describes the search string below?

| datamodel Application_State search

Events will be returned from dataset Application_State.

Events will be returned from the data model named Application_State.

No events will be returned; the pipe must occur after the data model command.

Events will be returned from the data model named Application_State (flat mode).

Question 42

When is a GET workflow action needed?

To send field values to an external resource.

To retrieve information from an external resource.

To use field values to perform a secondary search.

To define how events flow from forwarders to indexes.

Question 43

When using the transaction command, what does the argument maxspan do?

Sets the maximum total time between events in a transaction.

Sets the maximum length of all events within a transaction.

Sets the maximum total time between the earliest and latest events in a transaction.

Sets the maximum length that any single event can reach to be included in the transaction.

Question 44

Which of the following searches show a valid use of a macro? (Choose all that apply.)

index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField

index=main source=mySource oldField=* | stats if(‘makeMyField(oldField)’) | table _time newField

index=main source=mySource oldField=* | eval newField=’makeMyField(oldField)’| table _time newField

index=main source=mySource oldField=* | "’newField(‘makeMyField(oldField)’)’" | table _time newField