SPLK-1004問題集、Splunk実際の試験問題

質問 1

Which command is the opposite ofuntable?

A. xyseries

B. chart

C. bin

D. table

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 2

Which Job Inspector component displays the time taken to process field extractions?

A. command.search.regex

B. command.search.fields

C. command.search.filter

D. command.search.kv

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 3

Which of the following is valid syntax for the split function?

A. ... | eval split phoneNumber by " " as areaCodes.

B. ... | eval areaCodes = split(phoneNumber, " " )

C. ... | eval phoneNumber split( " - " , 3, areaCodes)

D. ... | eval split(phone-Number, " _ " , areaCodes)

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 4

Which of the following statements is accurate regarding the append command?

A. It cannot be used with a subsearch and only accesses real-time searches.

B. It is used with a subsearch and only accesses real-time searches.

C. It is used with a subsearch and only accesses historical data.

D. It cannot be used with a subsearch and only accesses historical data.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 5

How is regex passed to the makemv command?

A. It is specified by the delim argument.

B. makemv must be preceded by the rex command.

C. makemv must be preceded by the erex command.

D. It is specified by the tokenizer argument.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 6

Which of the following is true when comparing the rex and erex commands?

A. The rex command is similar to automatic field extraction while erex isn ' t

B. The rex command requires knowledge of regular expressions while erex doesn ' t

C. The erex command uses data samples to generate regular expressions while rex doesn ' t

D. The erex command requires knowledge of regular expressions while rex doesn ' t

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 7

Consider the following search:
(index=_internal log group=tcpin connections) earliest
| stats count as _count by sourceHost guid fwdType version
| eventstats dc(sourceHost) as dc_sourceHost by guid
| where dc_sourceHost > 1
| fields - dc_sourceHost
| xyseries guid fwdType sourceHost
| search guid= " 00507345-CE09-4A5E-428-D3E8718CB065 "
| appendpipe [ stats count | eval " Duplicate GUID " = if(count==0, " Yes " , " No " ) ] Which of the following are transforming commands?

A. where and search

B. stats and xyseries

C. eval and eventstats

D. fields and appendpipe

正解: B

解説: (PassTest メンバーにのみ表示されます)

Splunk Core Certified Advanced Power User - SPLK-1004 模擬練習