Font size
WorksheetsSplunk P-User Part 2
Total questions: 63
Worksheet time: 33mins
What is a limitation of searches generated by workflow actions?
Searches generated by workflow actions cannot use macros.
Searches generated by workflow actions must be less than 256 characters long.
Searches generated by workflow actions must run in the same app as the workflow action.
Searches generated by workflow actions run with the same permissions as the user running them.
Which of the following searches would create a graph similar to the one below?
Show Graph Image
index=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | stats count by status
index=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | chart count OVER status by _time
index=_internal sourcetype=SavedSplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status
None of these searches would generate a similar graph.
What does the transaction command do?
Groups a set of transactions based on time.
Creates a single event from a group of events.
Separates two events based on one or more values.
Returns the number of credit card transactions found in the event logs.
What is the relationship between data models and pivots?
Data models provide the datasets for pivots.
Pivots and data models have no relationship.
Pivots and data models are the same thing.
Pivots provide the datasets for data models.
Which of the following statements describes Search workflow actions?
By default, Search workflow actions will run as a real-time search.
Search workflow actions can be configured as scheduled searches.
The user can define the time range of the search when created the workflow action.
Search workflow actions cannot be configured with a search string that includes the transaction command.
Which of the following commands support the same set of functions?
stats, eval, table
search, where, eval
stats, chart, timechart
transaction, chart, timechart
The eval command allows you to do which of the following? (Choose all that apply.)
You Must Select All Correct Answers Below
Format values
Convert values
Perform calculations
Use conditional statements
When using the timechart command, how can a user group the events into buckets based on time?
Using the span argument.
Using the duration argument.
Using the interval argument.
Adjusting the fieldformat options.
Which of the following statements about data models and pivot are true? (Choose all that apply.)
They are both knowledge objects.
Data models are created out of datasets called pivots.
Pivot requires users to input SPL searches on data models.
Pivot allows the creation of data visualizations that present different aspects of a data model.
cData model fields can be added using the Auto-Extracted method.
Which of the following statements describe Auto-Extracted fields? (Choose all that apply.)
You Must Select All Correct Answers Below
Auto-Extracted fields can be hidden in Pivot.
Auto-Extracted fields can have their data type changed.
Auto-Extracted fields can be given a friendly name for use in Pivot.
Auto-Extracted fields can be added if they already exist in the dataset with constraints.
Which type of visualization shows relationships between discrete values in three dimensions?
Pie chart
Line chart
Bubble chart
Scatter chart
Which of the following is a function of the Splunk Common Information Model (CIM)?
Normalizing data across a Splunk deployment.
Providing templates for reports and dashboards.
Algorithmically shifting events to other indexes.
Reingesting previously indexed data with new field names.
What information must be included when using the datamodel command?
status field
Multiple indexes
Data model field name.
Data model dataset name.
Which of the following workflow actions can be executed from search results? (Choose all that apply.)
You Must Select All Correct Answers Below
GET
POST
LOOKUP
Search
Which of the following eval command functions is valid?
int()
count()
print()
tostring()
A calculated field may be based on which of the following?
Lookup tables
Extracted fields
Regular expressions
Fields generated within a search string
A data model can consist of what three types of datasets?
Pivot, searches, and events.
Pivot, events, and transactions.
Searches, transactions, and pivot.
Events, searches, and transactions.
When is a GET workflow action needed?
To send field values to an external resource.
To retrieve information from an external resource.
To use field values to perform a secondary search.
To define how events flow from forwarders to indexes.
Which of the following statements describe GET workflow actions?
GET workflow actions must be configured with POST arguments.
Configuration of GET workflow actions includes choosing a sourcetype.
Label names for GET workflow actions must include a field name surrounded by dollar signs.
GET workflow actions can be configured to open the URI link in the current window or in a new window.
Which are valid ways to create an event type? (Choose all that apply.)
By using the searchtypes command in the search bar.
By editing the event_type stanza in the props.conf file.
By going to the Settings menu and clicking Event Types > New.
By selecting an event in search results and clicking Event Actions > Build Event Type.
Which command can include both an over and a by clause to divide results into sub-groupings?
chart
stats
xyseries
transaction
When should you use the transaction command instead of the stats command?
When you need to group on multiple values.
When duration is irrelevant in search results.
When you have over 1000 events in a transaction.
When you need to group based on start and end constraints.
What does the Splunk Common Information Model (CIM) add-on include? (Choose all that apply.)
You Must Select All Correct Answers Below
Custom visualizations
Pre-configured data models
Fields and event category tags
Automatic data model acceleration
Which of the following statements about tags is true?
Tags are case insensitive.
Tags are created at index time.
Tags can make your data more understandable.
Tags are searched by using the syntax tag::<fieldname>
Which of the following file formats can be extracted using a delimiter field extraction?
CSV
XML
JSON
A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?
One
Two.
It depends on whether the original fields have the same name.
It depends on whether the two sourcetypes are associated with the same index.
In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")
The description field would contain no value.
The description field would contain the value 0.
The description field would contain the value "Internal Server Error".
This statement would produce an error in Splunk because it is incomplete.
In which Settings section are macros defined?
Fields
Tokens
Advanced Search
Searches, Reports, Alerts
Which of the following statements describes calculated fields?
Calculated fields are only used on fields added by lookups.
Calculated fields are a shortcut for repetitive and complex eval commands.
Calculated fields are a shortcut for repetitive and complex calc commands.
Calculated fields automatically calculate the simple moving average for indexed fields.
Which of the following are required to create a POST workflow action?
Label, URI, search string.
XML attributes, URI, name.
Label, URI, post arguments.
URI, search string, time range picker.
Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?
Access
Accounting
Authorization
Authentication
Which of the following statements describe the search below? (Choose all that apply.) index=main | transaction clientip host maxspan=30s maxpause=5s
You Must Select All Correct Answers Below
Events in the transaction occurred within 5 seconds.
It groups events that share the same clientip and host.
The first and last events are no more than 5 seconds apart.
The first and last events are no more than 30 seconds apart
Consider the following search:
index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD421K26502F783). View the events as a group.
From the following list, which search groups events by JSESSIONID?
index-web sourcetype=access_combined | transaction JSESSIONID | search SD42IK26502F783
index-web sourcetype=access_combined | highlight JSESSIONID | search SD421K26502F783
index=web sourcetype=access_combined SD42IK26502F783 | table JSESSIONID
index=web sourcetype=access_combined JSESSIONID <SD421K26502F783>
When defining a macro, what are the required elements?
Name and a validation error message.
Definition and arguments.
Name and arguments.
Name and definition.
Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?
Pivot users manual.
Search and reporting user manual.
CIM Add-on manual.
Data model command reference guide.
What is the correct syntax to find events associated with a tag?
tag:<field>=<value>
tags=<value>
tags:<field>=<value>
tag=<value>
Which of the following is true about the Splunk Common Information Model (CIM)?
The CIM contains 28 pre-configured datasets.
The data models included in the CIM are configured with data model acceleration turned on.
The data models included in the CIM are configured with data model acceleration turned off.
The CIM is an app that needs to run on the indexer.
Consider the following search run over a time range of last 7 days:
index=web sourcetype=access_combined | timechart avg(bytes) by product_name
Which option is used to change the default time span so that results are grouped into 12 hour intervals?
timespan=12
span=12h
timespan=12h
span=12
When would transaction be used instead of stats?
To have a faster and more efficient search.
To see results of a calculation.
To group events based on start/end values.
To group events based on a single field value.
Given the following eval statement:
... | eval field1 = if(isnotnull(fieid1),field1,0), field2 = if(isnull
Which of the following is the equivalent using fillnull?
There is no equivalent expression using fillnull
... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)
... | fillnull field1|' fillnull value="NO-VALUE" field2
... | fillnull value=0 field1 | fillnull field2
The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?
Saved searches
Lookups
KV Store
Data models
How is a Search Workflow Action configured to run at the same time range as the original search?
Select the "Use the same time range as the search that created the field listing" checkbox.
Set the earliest time to match the original search.
Select the same time range from the time-range picker.
Select the "Overwrite time range with the original search" checkbox.
A calculated field is a shortcut for performing repetitive, long, or complex transformations using which of the following commands?
transaction
eval
lookup
stats
When using the transaction command, how are evicted transactions identified?
_txn field is set to 1, or true.
open_txn field is set to l, or true.
max_txn field is set to 0, or false.
closed_txn field is set to 0, or false.
How are arguments defined within the macro search string?
“arg”
%arg%
$arg$
arg'
Which of the following objects can a calculated field use as a source?
An alias of a field.
A field added by an automatic lookup.
The tag field.
The eventtype field.
How are event types different from saved reports?
Event types can be shared with Splunk users and added to dashboards.
Event types include formatting of the search results.
Event types do not include a time range.
Event types cannot be used to organize data into categories.
When creating a data model, which root dataset requires at least one constraint?
Root event dataset
Root transaction dataset
Root search dataset
Root child dataset
Which search retrieves events with the event type web_errors?
tag=web_errors
eventtype=web_errors
eventtype(web_errors)
eventtype "web_errors"
When used with the timechart command, which value of the limit argument returns all values?
limit=none
limit=all
limit=0
limit=*
Which of the following statements best describes a macro?
A macro is a method of categorizing events based on a search.
A macro is a knowledge object that enables you to schedule searches for specific events.
A macro is a portion of a search that can be reused in multiple places.
A macro is a way to associate an additional (new) name with an existing field name.
The macro weekly_sales(2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?
'weekly_sales($3.99$, 10)'
'weekly_sales($3.99$, $10$)'
'weekly_sales(3.99, 10)'
'weekly_sales(3)'
What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?
There is a limit to the number of fields that can be extracted.
The user is unable to return to the automatic field extraction workflow.
The user is unable to preview the extractions.
The extraction is added at index time.
What does the fillnull command replace null values with, if the value argument is not specified?
NULL
0
NaN
N/A
What is the correct syntax for the transaction command?
| transaction(clientip,5m,1m)
| transaction clientip maxspan=5 pause=1
| transaction clientip maxspan=5m maxpause=1m
| transaction(clientip, 5, 1)
What is the Splunk Common Information Model (CIM)?
The CIM is a prerequisite that any data source must meet to be successfully onboarded into Splunk.
The CIM defines an ecosystem of apps that can be fully supported by Splunk.
The CIM provides a methodology to normalize data from different sources and source types.
The CIM is a data exchange initiative between software vendors.
For the following search, which field populates the x-axis?
index=security sourcetype=linux_secure | timechart count by action
_time
sourcetype
action
time
Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?
Event types
Tags
Field alias
Search workflow action
Which of the following transforming commands can be used with transactions?
chart, timechart, stats, eventstats
chart, timechart, stats, diff
chart, timechart, stats, pivot
chart, timechart, datamodel, pivot
What is the correct format for naming a macro with multiple arguments?
monthly_sales[3]
monthly_sales(3)
monthly_sales(argument 1, argument 2, argument 3)
monthly_sales[argument 1, argument 2, argument 3]
What are search macros?
A method to normalize fields.
Lookup definitions in lookup tables.
Categories of search results.
Reusable pieces of search processing language.
How is a macro referenced in a search?
By using the macroname command.
By enclosing the macro name in single-quote characters (').
By using the macro command.
By enclosing the macro name in backtick characters (').
Which of the following statements describes POST workflow actions?
POST workflow actions can open a web page in either the same window or a new window.
POST workflow actions are always encrypted.
POST workflow actions cannot use field values in their URI.
POST workflow actions cannot be created on custom sourcetypes.
