Question 1

The gauge command:

Options :

A : creates a single-value visualization

B : allows you to set colored ranges for a single-value visualization

C : creates a radial gauge visualization

Answer: B

Question 2

Which method in the Field Extractor would extract the port number from the following event? |

Options :

A : Delimiter

B : rex command

C : The Field Extractor tool cannot extract regular expressions.

D : Regular expression

Answer: B

Question 3

After manually editing; a regular expression (regex), which of the following statements is true?

Options :

A : Changes made manually can be reverted in the Field Extractor (FX) UI.

B : It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

C :

It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI

D :

The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

Answer: B

Question 4

Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

Options :

A : Field alias

B : Event types

C : Search workflow action

D : Tags

Answer: A

Question 5

What is the Splunk Common Information Model (CIM)?

Options :

A : The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.

B : The CIM provides a methodology to normalize data from different sources and source types.

C : The CIM defines an ecosystem of apps that can be fully supported by Splunk.

D : The CIM is a data exchange initiative between software vendors.

Answer: B

Free SPLK-1002 Mock Exam – Practice Online Confidently