Question 1

How can an existing accelerated data model be edited?

Options :

A : An accelerated data model can be edited once its .tsidx file has expired.

B : An accelerated data model can be edited from the Pivot tool.

C : The data model must be de-accelerated before edits can be made to its structure.

D : It cannot be edited. A new data model would need to be created.

Answer: C

Question 2

Which of the following options will define the first event in a transaction?

Options :

A : startswith

B : with

C : startingwith

D : firstevent

Answer: A

Question 3

Highlighted search terms indicate _________ search results in Splunk.

Options :

A : Display as selected fields.

B : Sorted

C : Charted based on time

D : Matching

Answer: D

Question 4

For choropleth maps,splunk ships with the following KMZ files (select all that apply)

Options :

A : States of the United States

B : States and provinces of the united states and Canada

C : Countries of the European Union

D : Countries of the World

Answer: A,D

Question 5

Which of the following searches would create a graph similar to the one below?

Options :

A :

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

B :

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

C :

index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

D : None of these searches would generate a similart graph.

Answer: C

Higher Test Marks with Free Online SPLK-1002 Exam Practice