SPLK-1002 Splunk Core Certified Power User exam is a hot Splunk certification exam, Exam4Training offers you the latest free online SPLK-1002 dumps to practice. You can get online training in the following questions, all these questions are verified by Splunk experts. If this exam changed, we will share new update questions.
When creating a Search workflow action, which field is required?
A . Search string
B . Data model name
C . Permission setting
D . An eval statement
Answer: A
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Setupasearchworkflowacti
on
Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)
A . Alerts
B . Email
C . Database
D . User permissions
Answer: A,B,C
Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview
When using timechart, how many fields can be listed after a by clause?
A . because timechart doesn’t support using a by clause.
B . because _time is already implied as the x-axis.
C . because one field would represent the x-axis and the other would represent the y-axis.
D . There is no limit specific to timechart.
Answer: B
Which of the following statements describes Search workflow actions?
A . By default. Search workflow actions will run as a real-time search.
B . Search workflow actions can be configured as scheduled searches,
C . The user can define the time range of the search when created the workflow action.
D . Search workflow actions cannot be configured with a search string that includes the transaction command
Answer: C
Which of the following knowledge objects represents the output of an eval expression?
A . Eval fields
B . Calculated fields
C . Field extractions
D . Calculated lookups
Answer: B
Explanation:
Reference: https://docs.splunk.com/Splexicon:Calculatedfield
Data model fields can be added using the Auto-Extracted method .
Which of the following statements describe Auto-Extracted fields? (select all that apply)
A . Auto-Extracted fields can be hidden in Pivot.
B . Auto-Extracted fields can have their data type changed.
C . Auto-Extracted fields can be given a friendly name for use in Pivot.
D . Auto-Extracted fields can be added if they already exist in the dataset with constraints.
Answer: A,B,C,D
What does the transaction command do?
A . Groups a set of transactions based on time.
B . Creates a single event from a group of events.
C . Separates two events based on one or more values.
D . Returns the number of credit card transactions found in the event logs.
Answer: B
Data model are composed of one or more of which of the following datasets? (select all that apply.)
A . Events datasets
B . Search datasets
C . Transaction datasets
D . Any child of event, transaction, and search datasets
Answer: A,B,C
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels
When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?
A . The regex can no longer be edited.
B . The field being extracted will be required for all future events.
C . The events without the required field will not display in searches.
D . Only events with the required string will be included in the extraction.
Answer: D
Which of the following statements describes POST workflow actions?
A . POST workflow actions are always encrypted.
B . POST workflow actions cannot use field values in their UR
D . POST workflow actions cannot be created on custom sourcetypes.
E . POST workflow actions can open a web page in either the same window or a new.
Answer: D