Question 1

Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)

Options :

A :

Select an additional sample event with the Field Extractor (FX) and highlight the missing value in the event.

B : Re-ingest the data and attempt to extract from a new dataset.

C : Click on the event where the field was not extracted and choose “Change to Delimited".

D : Edit the regular expression manually.

Answer: A,D

Question 2

Which of the following statements describe GET workflow actions?

Options :

A : GET workflow actions must be configured with POST arguments.

B : Configuration of GET workflow actions includes choosing a sourcetype.

C : Label names for GET workflow actions must include a field name surrounded by dollar signs.

D :

GET workflow actions can be configured to open the URT link in the current window or in a new window

Answer: D

Question 3

What information must be included when using the datamodel command?

Options :

A : status field

B : Multiple indexes

C : Data model field name.

D : Data model dataset name.

Answer: D

Question 4

What type of command is eval?

Options :

A : Streaming in some modes

B : Report generating

C : Distributable streaming

D : Centralized streaming

Answer: C

Question 5

What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

Options :

A : Consult the CIM data model reference tables.

B : Run a search using the authentication command.

C : Consult the CIM event type reference tables.

D : Run a search using the correlation comman

Answer: A

Higher Test Marks with Free Online SPLK-1002 Exam Practice

Buying Options: