Question 1

How do event types help a user search their data?

Options :

A :

Event types can optimize data storage.

B :

Event types improve dashboard performance.

C : Event types improve search performance.

D : Event types categorize events based on a search string.

Answer: D

Question 2

Which method in the Field Extractor would extract the port number from the following event? |

Options :

A : Delimiter

B : rex command

C : The Field Extractor tool cannot extract regular expressions.

D : Regular expression

Answer: B

Question 3

Which tool uses data models to generate reports and dashboard panels without using SPL?

Options :

A : Visualization tab

B : Pivot

C : Datasets

D : splunk CIM

Answer: B

Question 4

Which of the following is true about the Splunk Common Information Model (CIM)?

Options :

A : The data models included in the CIM are configured with data model acceleration turned off.

B : The CIM contains 28 pre-configured datasets.

C : The CIM is an app that needs to run on the indexer.

D : The data models included in the CIM are configured with data model acceleration turned on.

Answer: D

Question 5

Which option of the transaction command would be used to specify the maximum time between events in a transaction?

Options :

A : maxpause

B : maxspan

C : duration

D : eventcount

Answer: A

Free SPLK-1002 Mock Exam – Practice Online Confidently