Question 1

A data model can consist of what three types of datasets?

Options :

A : Pivot, searches, and events.

B : Pivot, events, and transactions.

C : Searches, transactions, and pivot.

D : Events, searches, and transactions.

Answer: D

Question 2

Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

Options :

A : Macros

B : Lookups

C : Workflow actions

D : Field extractions

Answer: B

Question 3

Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

Options :

A : | datamodel web search | filed web *

B : | Search datamodel web web | filed web*

C : | datamodel web web field | search web*

D : Datamodel=web | search web | filed web*

Answer: A

Question 4

Which of the following statements describes the command below (select all that apply)

Sourcetype=access_combined | transaction JSESSIONID

Options :

A : An additional filed named maxspan is created.

B : An additional field named duration is created.

C : An additional field named eventcount is created.

D : Events with the same JSESSIONID will be grouped together into a single event.

Answer: B,C,D

Question 5

Which of the following Statements about macros is true? (select all that apply)

Options :

A : Arguments are defined at execution time.

B : Arguments are defined when the macro is created.

C : Argument values are used to resolve the search string at execution time.

D : Argument values are used to resolve the search string when the macro is created.

Answer: B,C

Higher Test Marks with Free Online SPLK-1002 Exam Practice