Weekend Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Free and Premium Splunk SPLK-1004 Dumps Questions Answers

Page: 1 / 9
Total 120 questions

Splunk Core Certified Advanced Power User Exam Questions and Answers

Question 1

Which of the following could be used to build a contextual drilldown?

Options:

A.

<set>and<unset>elements with adepend?attribute.

B.

$earliest$and$latest$tokens set by a global time range picker.

C.

<set>and<reset>elements with arejectsattribute.

D.

<set>and<offset>elements withdependsandrejectsattributes.

Buy Now
Question 2

Which commands should be used in place of a subsearch if possible?

Options:

A.

untable and/or xyseries

B.

stats and/or eval

C.

mvexpand and/or where

D.

bin and/or where

Question 3

When using thebincommand, what attributes are used to define the size and number of sets created?

Options:

A.

binsandstartandend

B.

binsandminspan

C.

binsandspan

D.

binsandlimit

Question 4

Why use the tstats command?

Options:

A.

As an alternative to the summary command.

B.

To generate statistics on indexed fields.

C.

To generate an accelerated data model.

D.

To generate statistics on search-time fields.

Question 5

Where does the output of an append command appear in the search results?

Options:

A.

Added as a column to the right of the search results.

B.

Added as a column to the left of the search results.

C.

Added to the beginning of the search results.

D.

Added to the end of the search results.

Question 6

Which predefined drilldown token passes a clicked value from a table row?

Options:

A.

$table.$

B.

$rowclick.$

C.

$row.$

D.

$tableclick.$

Question 7

Which of the following drilldown methods does not exist in dynamic dashboards?

Options:

A.

Contextual Drilldown

B.

Dynamic Drilldown

C.

Custom Drilldown

D.

Static Drilldown

Question 8

What is returned when Splunk finds fewer than the minimum matches for each lookup value?

Options:

A.

The default value NULL until the minimum match threshold is reached.

B.

The default match value until the minimum match threshold is reached.

C.

The first match unless the time_field attribute is specified.

D.

Only the first match.

Question 9

Which of the following best describes the process for tokenizing event data?

Options:

A.

The event data is broken up by values in the punch field.

B.

The event data is broken up by major breakers and then broken up further by minor breakers.

C.

The event data is broken up by a series of user-defined regex patterns.

D.

The event data has all punctuation stripped out and is then space-delimited.

Question 10

Which of the following will best optimize dashboard performance?

Options:

A.

Use inline searches.

B.

Use base searches.

C.

Use accelerated data models.

D.

Use scheduled reports.

Question 11

Which field is required for an event annotation?

Options:

A.

annotation_category

B.

_time

C.

eventtype

D.

annotation_label

Question 12

What is an example of the simple XML syntax for a base search and its post-process search?

Options:

A.

,

B.

,

C.

,

D.

,

Question 13

Where can wildcards be used in the tstats command?

Options:

A.

In the where clause

B.

In the by clause

C.

In the from clause

D.

No wildcards can be used with tstats

Question 14

If a search contains a subsearch, what is the order of execution?

Options:

A.

The order of execution depends on whether either search uses a stats command.

B.

The inner search executes first.

C.

The outer search executes first.

D.

The two searches are executed in parallel.

Question 15

Which of the following is an event handler action?

Options:

A.

Run an eval statement based on a user clicking a value on a form.

B.

Set a token to select a value from the time range picker.

C.

Pass a token from a drilldown to modify index settings.

D.

Cancel all jobs based on the number of search job results captured.

Question 16

Which command calculates statistics on search results as each search result is returned?

Options:

A.

streamstats

B.

fieldsummary

C.

eventstats

D.

appendpipe

Question 17

When using the bin command, which argument sets the bin size?

Options:

A.

maxDataSizeMB

B.

max

C.

volume

D.

span

Question 18

What happens to panels with post-processing searches when their base search is refreshed?

Options:

A.

The panels are deleted.

B.

The panels are only refreshed if they have also been configured.

C.

The panels are refreshed automatically.

D.

Nothing happens to the panels.

Question 19

Which of the following is a valid use of the eval command?

Options:

A.

To filter events based on a condition.

B.

To calculate the sum of a numeric field across all events.

C.

To create a new field based on an existing field's value.

D.

To group events by a specific field.

Question 20

Which statement about the coalesce function is accurate?

Options:

A.

It can take only a single argument.

B.

It can take a maximum of two arguments.

C.

It can be used to create a new field in the results set.

D.

It can return null or non-null values.

Question 21

Which of the following is a valid event action in Splunk?

Options:

A.

Execute an eval statement.

B.

Edit an event in the raw data.

C.

Execute a stats statement.

D.

Create a new REST API endpoint.

Question 22

A report named "Linux logins" populates a summary index with the search string sourcetype=linux_secure | sitop src_ip user. Which of the following correctly searches against the summary index for this data?

Options:

A.

index=summary sourcetype="linux_secure" | top src_ip user

B.

index=summary search_name="Linux logins" | top src_ip user

C.

index=summary search_name="Linux logins" | stats count by src_ip user

D.

index=summary sourcetype="linux_secure" | stats count by src_ip user

Question 23

What are the four types of event actions?

Options:

A.

stats, target, set, and unset

B.

stats, target, change, and clear

C.

eval, link, change, and clear

D.

eval, link, set, and unset

Question 24

What is the correct hierarchy of XML elements in a dashboard panel?

Options:

A.

B.

C.

D.

Question 25

What does using the tstats command with summariesonly=false do?

Options:

A.

Returns results from only non-summarized data.

B.

Returns results from both summarized and non-summarized data.

C.

Prevents the use of wildcard characters in aggregate functions.

D.

Returns no results.

Question 26

Which of the following are predefined tokens?

Options:

A.

$earliest_tok$and$now$

B.

?click.field?and?click.value?

C.

?earliest_tok$and?latest_tok?

D.

?click.name?and?click.value?

Question 27

What is the function of the |s token filter?

Options:

A.

|s is not a valid token filter.

B.

To wrap a value in double quotes.

C.

To force no encoding to occur.

D.

To encode URL values.

Question 28

Which statement about.tsidxfiles is accurate?

Options:

A.

A.tsidxfile consists of a lexicon and a posting list.

B.

Splunk removes outdated.tsidxfiles every 5 minutes.

C.

Splunk updates.tsidxfiles every 30 minutes.

D.

Each bucket in each index may contain only one.tsidxfile.

Question 29

Which function of the stats command creates a multivalue entry?

Options:

A.

mvcombine

B.

eval

C.

makemv

D.

list

Question 30

What file types does Splunk use to define geospatial lookups?

Options:

A.

GPX or GML files

B.

TXT files

C.

KMZ or KML files

D.

CSV files

Question 31

Which of the following would exclude all entries contained in the lookup file baditems.csv from search results?

Options:

A.

NOT [inputlookup baditems.csv]

B.

NOT (lookup baditems.csv OUTPUT item)

C.

WHERE item NOT IN (baditems.csv)

D.

[NOT inputlookup baditems.csv]

Question 32

Which of the following is true about thesummariesonly=targument of thetstatscommand?

Options:

A.

Applies only to accelerated data models.

B.

When using an unaccelerated data model, the search produces a larger result count than withsummariesonly=f.

C.

Applies only to unaccelerated data models.

D.

When using an accelerated data model, the search produces a larger result count than withsummariesonly=f.

Question 33

What default Splunk role can use the Log Event alert action?

Options:

A.

Power

B.

User

C.

can_delete

D.

Admin

Question 34

How can form inputs impact dashboard panels using inline searches?

Options:

A.

Panels powered by an inline search require a minimum of one form input.

B.

Form inputs cannot impact panels using inline searches.

C.

Adding a form input to a dashboard converts all panels to prebuilt panels.

D.

A token in a search can be replaced by a form input value.

Question 35

Which of the following elements sets a token value of sourcetype=access_combined?

Options:

A.

sourcetype=$click.value$

B.

prefix="sourcetype=">$click.value$

C.

sourcetype=$click.value$

D.

$click.value$

Question 36

The fieldproductscontains a multivalued field containing the names of products. What is the result of the commandmvexpand products limit=<x>?

Options:

A.

Compressed values inproductswill be uncompressed.

B.

Separate events will be created for each product inproducts.

C.

productswill be converted from a single value field to a multivalue field.

D.

All multivalue fields will be converted to single value fields.

Page: 1 / 9
Total 120 questions