合格できるSplunk Splunk Core Certified Power User Exam試験最速合格保証最近更新されたPassTest問題集！
合格できるSPLK-1002試験の259問題で最適なPassTest出題問題
質問 # 31
By default search results are not returned in ________ order.
- A. ASCIE
- B. Chronological
- C. Alphabetical
- D. Reverser chronological
正解：B、C
質問 # 32
Which of the following transforming commands can be used with transactions?
- A. chart, timeehart, datamodel, pivot
- B. chart, timechart, stats, diff
- C. chart, timechart, stats, eventstats
- D. chart, timecha:t, stats, pivot
正解：C
解説：
Explanation
The correct answer is A. chart, timechart, stats, eventstats.
Transforming commands are commands that change the format of the search results into a table or a chart.
They can be used to perform statistical calculations, create visualizations, or manipulate data in various ways1.
Transactions are groups of events that share some common values and are related in some way. Transactions can be defined by using the transaction command or by creating a transaction type in the transactiontypes.conf file2.
Some transforming commands can be used with transactions to create tables or charts based on the transaction fields. These commands include:
chart: This command creates a table or a chart that shows the relationship between two or more fields. It can be used to aggregate values, count occurrences, or calculate statistics3.
timechart: This command creates a table or a chart that shows how a field changes over time. It can be used to plot trends, patterns, or outliers4.
stats: This command calculates summary statistics on the fields in the search results, such as count, sum, average, etc. It can be used to group and aggregate data by one or more fields5.
eventstats: This command calculates summary statistics on the fields in the search results, similar to stats, but it also adds the results to each event as new fields. It can be used to compare events with the overall statistics.
These commands can be applied to transactions by using the transaction fields as arguments. For example, if you have a transaction type named "login" that groups events based on the user field and has fields such as duration and eventcount, you can use the following commands with transactions:
| chart count by user : This command creates a table or a chart that shows how many transactions each user has.
| timechart span=1h avg(duration) by user : This command creates a table or a chart that shows the average duration of transactions for each user per hour.
| stats sum(eventcount) as total_events by user : This command creates a table that shows the total number of events for each user across all transactions.
| eventstats avg(duration) as avg_duration : This command adds a new field named avg_duration to each transaction that shows the average duration of all transactions.
The other options are not valid because they include commands that are not transforming commands or cannot be used with transactions. These commands are:
diff: This command compares two search results and shows the differences between them. It is not a transforming command and it does not work with transactions.
datamodel: This command retrieves data from a data model, which is a way to organize and categorize data in Splunk. It is not a transforming command and it does not work with transactions.
pivot: This command creates a pivot report, which is a way to analyze data from a data model using a graphical interface. It is not a transforming command and it does not work with transactions.
References:
About transforming commands
About transactions
chart command overview
timechart command overview
stats command overview
[eventstats command overview]
[diff command overview]
[datamodel command overview]
[pivot command overview]
質問 # 33
Which of the following searches will return events containing a tag named Privileged?
- A. tag=priv*
- B. tag=Priv
- C. tag=Priv*
- D. tag=privileged
正解：C
質問 # 34
Which function should you use with the transaction command to set the maximum total time between the
earliest and latest events returned?
- A. maxduration
- B. maxpause
- C. endswith
- D. maxspan
正解：D
解説：
The maxspan function of the transaction command allows you to set the maximum total time between the
earliest and latest events returned. The maxspan function is an argument that can be used with the transaction
command to specify the start and end constraints for the transactions. The maxspan function takes a time
modifier as its value, such as 30s, 5m, 1h, etc. The maxspan function sets the maximum time span between the
first and last events in a transaction. If the time span between the first and last events exceeds the maxspan
value, the transaction will be split into multiple transactions.
質問 # 35
In what order arc the following knowledge objects/configurations applied?
- A. Lookups, Field Aliases, Field Extractions
- B. Field Aliases, Field Extractions, Lookups
- C. Field Extractions, Lookups, Field Aliases
- D. Field Extractions, Field Aliases, Lookups
正解：C
解説：
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/WhatisSplunkknowledge
質問 # 36
When would transaction be used instead of stats?
- A. To have a faster and more efficient search.
- B. To group events based on a single field value.
- C. To see results of a calculation.
- D. To group events based on start/end values.
正解：D
解説：
The transaction command is used to group events that are related by some common fields or conditions, such as start/end values, time span, or pauses. The stats command is used to calculate statistics on a group of events by a common field value.
Reference
Splunk Community
Splunk Transaction - Exact Details You Need
質問 # 37
Which of the following about reports is/are true?
- A. Reports can run a script.
- B. Reports can be scheduled.
- C. Reports are knowledge objects.
- D. All of the above.
正解：D
質問 # 38
Which of the following statements describe calculated fields? (select all that apply)
- A. Calculated fields are shortcuts for performing calculations using the eval command.
- B. Calculated fields can only be applied to host and sourcetype.
- C. Calculated fields can be used in the search bar.
- D. Calculated fields can be based on an extracted field.
正解：A、C、D
解説：
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields Calculated fields are fields that are created by performing calculations on existing fields using the eval command. Calculated fields can be used in the search bar to filter and transform events based on the calculated values. Calculated fields can also be based on an extracted field, which is a field that is extracted from raw data using various methods, such as regex, delimiters, lookups, etc. Calculated fields are not shortcuts for performing calculations using the eval command, but rather results of performing calculations using the eval command. Calculated fields can be applied to any field in Splunk, not only host and sourcetype.
Therefore, statements A, B, and D are true about calculated fields.
質問 # 39
Which type of visualization shows relationships between discrete values in three dimensions?
- A. Scatter chart
- B. Bubble chart
- C. Pie chart
- D. Line chart
正解：B
解説：
Explanation
https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/chartsBub
質問 # 40
Which of the following statements about data models and pivot are true? (select all that apply)
- A. Data models are created out of datasets called pivots.
- B. They are both knowledge objects.
- C. Pivot requires users to input SPL searches on data models.
- D. Pivot allows the creation of data visualizations that present different aspects of a data model.
正解：D
解説：
Data models and pivot are both knowledge objects in Splunk that allow you to analyze and visualize your data
in different ways. Data models are collections of datasets that represent your data in a structured and
hierarchical way. Data models define how your data is organized into objects and fields. Pivot is a user
interface that allows you to create data visualizations that present different aspects of a data model. Pivot does
not require users to input SPL searches on data models, but rather lets them select options from menus and
forms. Data models are not created out of datasets called pivots, but rather pivots are created from datasets in
data models.
質問 # 41
Which of the following is a feature of the Pivot tool?
- A. Creates lookups without using SPL.
- B. Creates reports without using SPL
- C. Datasets are not required.
- D. Data Models are not required.
正解：B
解説：
The correct answer is C. Creates reports without using SPL. This is because the Pivot tool is a feature of Splunk that allows you to report on a specific data set without using the Splunk Search Processing Language (SPL). You can use a drag-and-drop interface to design and generate pivots that present different aspects of your data in the form of tables, charts, and other visualizations. You can learn more about the Pivot tool from the Splunk documentation1 or watch a video tutorial2. The other options are incorrect because they do not describe the features of the Pivot tool. The Pivot tool requires data models and datasets to define the data that you want to work with. Data models and datasets are designed by the knowledge managers in your organization. You can learn more about data models and datasets from the Splunk documentation3. The Pivot tool does not create lookups, which are tables that match field values to other field values. You can create lookups using SPL or the Lookup Editor. You can learn more about lookups from the Splunk documentation.
質問 # 42
Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID
- A. An additional field named duration is created.
- B. Events with the same JSESSIONID will be grouped together into a single event.
- C. An additional filed named maxspan is created.
- D. An additional field named eventcount is created.
正解：A、B、D
解説：
The command sourcetype=access_combined | transaction JSESSIONID does three things:
It filters the events by the sourcetype access_combined, which is a predefined sourcetype for Apache web server logs.
It groups the events by the field JSESSIONID, which is a unique identifier for each user session.
It creates a single event from each group of events that share the same JSESSIONID value. This single event will have some additional fields created by the transaction command, such as duration, eventcount, and startime.
Therefore, the statements B, C, and D are true.
質問 # 43
Which of the following searches would return a report of sales by product-name?
- A. stats sum(price) as sales over product_name
- B. chart sum(price) as sales by product_name
- C. chart sales by product_name
- D. timechart list(sales), values(product_name)
正解：A
質問 # 44
The command shown here does witch of the following: Command: |outputlookup products.csv
- A. Writes search results to a file named products.csv
- B. Returns the contents of a file named products.csv
正解：A
質問 # 45
This search user!=*_________________.
- A. displays only events that contain a value for user
- B. displays all events
- C. displays only events that do NOT contain a value for user
正解：C
質問 # 46
Which of the following searches will return events contains a tag name Privileged?
- A. Tag= Privileged
- B. Tag= Priv
- C. Tag= Priv*
- D. Tag= Pri*
正解：D
解説：
Reference:https://docs.splunk.com/Documentation/PCI/4.1.0/Install/PrivilegedUserActivity
質問 # 47
In which of the following scenarios is an event type more effective than a saved search?
- A. When formatting needs to be included with the search string.
- B. When a search should always include the same time range.
- C. When a search needs to be added to other users' dashboards.
- D. When the search string needs to be used in future searches.
正解：A
解説：
Reference:https://answers.splunk.com/answers/4993/eventtype-vs-saved-search.html
質問 # 48
What are the expected results for a search that contains the command | where A=B?
- A. Events where values of field are equal to values of field B.
- B. Events that contain the string value A=B.
- C. Events where field A contains the string value B.
- D. Events that contain the string value where A=B.
正解：A
解説：
Explanation
The correct answer is C. Events where values of field A are equal to values of field B.
The where command is used to filter the search results based on an expression that evaluates to true or false.
The where command can compare two fields, two values, or a field and a value. The where command can also use functions, operators, and wildcards to create complex expressions1.
The syntax for the where command is:
| where <expression>
The expression can be a comparison, a calculation, a logical operation, or a combination of these. The expression must evaluate to true or false for each event.
To compare two fields with the where command, you need to use the field names without any quotation marks. For example, if you want to find events where the values for the field A match the values for the field B, you can use the following syntax:
| where A=B
This will return only the events where the two fields have the same value.
The other options are not correct because they use different syntax or fields that are not related to the where command. These options are:
A: Events that contain the string value where A=B: This option uses the string value where A=B as a search term, which is not valid syntax for the where command. This option will return events that have the literal text "where A=B" in them.
B: Events that contain the string value A=B: This option uses the string value A=B as a search term, which is not valid syntax for the where command. This option will return events that have the literal text
"A=B" in them.
D: Events where field A contains the string value B: This option uses quotation marks around the value B, which is not valid syntax for comparing fields with the where command. Quotation marks are used to enclose phrases or exact matches in a search2. This option will return events where the field A contains the string value "B".
References:
where command usage
Search command cheatsheet
質問 # 49
A real-time alert is ______________.
- A. A scheduled alert
- B. constantly running in the background
正解：B
質問 # 50
When should you use the transaction command instead of the scats command?
- A. When you have over 1000 events in a transaction.
- B. When you need to group on multiple values.
- C. When duration is irrelevant in search results. .
- D. When you need to group based on start and end constraints.
正解：A
質問 # 51
......
合格突破受験者シミュレーションされたSPLK-1002試験問題集：https://www.passtest.jp/Splunk/SPLK-1002-shiken.html
無料テストエンジンはSplunk Core Certified Power User Exam認定試験：https://drive.google.com/open?id=1AroxOhWuuNZBXXAeL9Yk7S0UBh2sQhIc