最新版無料体験を掴み取れ！Splunk SPLK-1002日本語問題集PDFは更新されたのは2025年
最新リリースのSPLK-1002日本語問題集はSplunk Core Certified Power User認証済みです
質問 # 158
計算フィールドは、次のうちどれに基づいている可能性がありますか？
- A. 検索文字列内で生成されたフィールド
- B. 正規表現
- C. 抽出されたフィールド
- D. ルックアップテーブル
正解：C
解説：
As mentioned before, a calculated field is a field that you create based on the value of another field or fields2. A calculated field can be based on extracted fields, which are fields that are extracted from your raw data using various methods such as regular expressions, delimiters or key-value pairs2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of fields that a calculated field can be based on.
質問 # 159
これはSplunkの比較演算子ではありません
- A. >
- B. <=
- C. ！=
- D. ？=
- E. =
正解：D
解説：
Explanation
A comparison operator is a symbol that compares two values and returns a Boolean result (true or false)2. Splunk supports various comparison operators such as <, >, =, !=, <=, >=, IN and LIKE2. However,
?= is not a valid comparison operator in Splunk and will cause a syntax error if used in a search string2.
Therefore, option E is correct, while options A, B, C and D are incorrect because they are valid comparison operators in Splunk
質問 # 160
ユーザーは次の検索を実行します。
Index-X sourcetype=YI chart count (domain) as count、sum (price) as sum by product、action usenull=f useother-f 次のテーブル ヘッダーのうち、このコマンドが作成する順序と一致するものはどれですか?
- A. カウント: 積、合計: 積、カウント: アクション、合計: アクション
- B. chart コマンドでは複数の統計関数を使用できません。
- C. 製品、カウント: カートに追加、カウント: 削除、カウント: 購入、合計: カートに追加、合計: 削除、合計: 購入
- D. 製品、合計: カートに追加、合計: 削除、合計: 購入、カウント: カートに追加、カウント: 削除、カウント: 購入
正解：C
解説：
The correct answer isC. Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum:
remove, sum: purchase1.
In Splunk, thechartcommand is used to create a table or a chart visualization from your
data2.Thechartcommand takes at least one function and one field, and optionally another field to group by2.
In the given search, thechartcommand is used with two functions (countandsum), two fields (domainandprice),
and two fields to group by (productandaction).Theusenull=fanduseother=foptions are used to exclude null
values and other values from the chart2.
Thechartcommand creates a table with headers that match the order of the fields and functions in the
command1.The headers for thecountfunction are prefixed withcount:, and the headers for thesumfunction are
prefixed withsum:1.The values of theproductandactionfields are used as the suffixes for the headers1.
Therefore, the table headers created by this command areProduct,count: addtocart,count: remove,count:
purchase,sum: addtocart,sum: remove, andsum: purchase1.
質問 # 161
以下のマクロ定義では、マクロを正しく構成するために、名前と引数のフィールドに何を入力する必要がありますか?
- A. マクロ名は sessiontracker で、引数は $action$、$JESSIONID$ です。
- B. マクロ名はsessiontracker(2)で、引数はaction、JESSIONIDです。
- C. マクロ名はsessiontracker(2)で、引数は$action$、$JESSIONID$です。
- D. マクロ名は sessiontracker で、引数は action、JESSIONID です。
正解：B
解説：
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros The macro definition below shows a macro that tracks user sessions based on two arguments: action and JSESSIONID.
sessiontracker(2)
The macro definition does the following:
It specifies the name of the macro as sessiontracker. This is the name that will be used to execute the macro in a search string.
It specifies the number of arguments for the macro as 2. This indicates that the macro takes two arguments when it is executed.
It specifies the code for the macro asindex=main sourcetype=access_combined_wcookie action=$action$ JSESSIONID=$JSESSIONID$ | stats count by JSESSIONID. This is the search string that will be run when the macro is executed. The search string can contain any part of a search, such as search terms, commands, arguments, etc. The search string can also include variables for the arguments using dollar signs around them.
In this case, action and JSESSIONID are variables for the arguments that will be replaced by their values when the macro is executed.
Therefore, to correctly configure the macro, you should enter sessiontracker as the name and action, JSESSIONID as the arguments. Alternatively, you can use sessiontracker(2) as the name and leave the arguments blank.
質問 # 162
timechartコマンドは、以下に応じた時間間隔でデータをバケット化します。
- A. 返されたイベントの数
- B. 選択した視覚化のタイプ
- C. 選択した時間範囲
正解：C
解説：
Explanation
The timechart command buckets data in time intervals depending on the selected time range2. The timechart command is similar to the chart command but it automatically groups events into time buckets based on the
_time field2. The size of the time buckets depends on the time range that you select for your search. For example, if you select Last 24 hours as your time range, Splunk will use 30-minute buckets for your timechart. If you select Last 7 days as your time range, Splunk will use 4-hour buckets for your timechart2.
Therefore, option B is correct, while options A and C are incorrect because they are not factors that affect the size of the time buckets.
質問 # 163
検索を完了してください。_____ 失敗＞成功
- A. の場合
- B. 検索
- C. どこ
正解：C
解説：
Any of the above
Explanation:
The where command can be used to complete the search below.
... | where failure>successes
The where command is a search command that allows you to filter events based on complex or custom criteri a. The where command can use any boolean expression or function to evaluate each event and determine whether to keep it or discard it. The where command can also compare fields or perform calculations on fields using operators such as >, <, =, +, -, etc. The where command can be used after any transforming command that creates a table or a chart.
The search string below does the following:
It uses ... to represent any search criteria or commands before the where command.
It uses the where command to filter events based on a comparison between two fields: failure and successes.
It uses the greater than operator (>) to compare the values of failure and successes fields for each event.
It only keeps events where failure is greater than successes.
質問 # 164
次のシナリオのうち、保存された検索よりもイベントタイプの方が効果的ですか？
- A. 今後の検索で検索文字列を使用する必要がある場合。
- B. 検索に常に同じ時間範囲を含める必要がある場合。
- C. フォーマットを検索文字列に含める必要がある場合。
- D. 他のユーザーのダッシュボードに検索を追加する必要がある場合。
正解：A
解説：
Reference: https://answers.splunk.com/answers/4993/eventtype-vs-saved-search.html
質問 # 165
データモデルは、次のデータセットの1つ以上で構成されていますか？ （該当するものをすべて選択。）
- A. トランザクションデータセット
- B. イベントデータセット
- C. データセットを検索する
- D. イベント、トランザクション、検索データセットの子
正解：A、B、C
解説：
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels
Data models are collections of datasets that represent your data in a structured and hierarchical way. Data
models define how your data is organized into objects and fields. Data models can be composed of one or
more of the following datasets:
Events datasets: These are the base datasets that represent raw events in Splunk. Events datasets can be filtered
by constraints, such as search terms, sourcetypes, indexes, etc.
Search datasets: These are derived datasets that represent the results of a search on events or other datasets.
Search datasets can use any search command, such as stats, eval, rex, etc., to transform the data.
Transaction datasets: These are derived datasets that represent groups of events that are related by fields, time,
or both. Transaction datasets can use the transaction command or event types with transactiontype=true to
create transactions.
質問 # 166
productName フィールドと product:d フィールドに特定のイベントの値がある場合、どのフィールドを使用してフィールドに値を設定しますか?
| eval productINFO=coalesco(製品名,製品ID)
- A. 2 番目に表示されるフィールドの値。
- B. 両方のフィールド値が使用され、製品情報フィールドは指定されたイベントの複数値フィールドになります。
- C. どちらのフィールド値も使用されず、フィールドには指定されたイベントの NULL 値が割り当てられます。
- D. 最初に表示されるため、productName フィールドの値。
正解：D
解説：
Explanation
The correct answer is B. The value for the productName field because it appears first.
The coalesce function is an eval function that takes an arbitrary number of arguments and returns the first value that is not null. A null value means that the field has no value at all, while an empty value means that the field has a value, but it is "" or zero-length1.
The coalesce function can be used to combine fields that have different names but represent the same data, such as IP address or user name. The coalesce function can also be used to rename fields for clarity or convenience2.
The syntax for the coalesce function is:
coalesce(<field1>,<field2>,...)
The coalesce function will return the value of the first field that is not null in the argument list. If all fields are null, the coalesce function will return null.
For example, if you have a set of events where the IP address is extracted to either clientip or ipaddress, you can use the coalesce function to define a new field called ip, that takes the value of either clientip or ipaddress, depending on which is not null:
| eval ip=coalesce(clientip,ipaddress)
In your example, you have a set of events where the product name is extracted to either productName or productid, and you use the coalesce function to define a new field called productINFO, that takes the value of either productName or productid, depending on which is not null:
| eval productINFO=coalesce(productName,productid)
If both productName and productid fields have values for a given event, the coalesce function will return the value of the productName field because it appears first in the argument list. The productid field will be ignored by the coalesce function.
Therefore, the value for the productName field will be used to populate the productINFO field if both fields have values for a given event.
References:
Search Command> Coalesce
USAGE OF SPLUNK EVAL FUNCTION : COALESCE
質問 # 167
Field Extractor（FX）はどの区切り文字を検出できますか？ （該当するものをすべて選択）
- A. カンマ
- B. タブ
- C. スペース
- D. パイプ
正解：A、C、D
解説：
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/FXSelectMethodstep
The Field Extractor (FX) is a tool that helps you extract fields from your data using delimiters or regular
expressions. Delimiters are characters or strings that separate fields in your data. The FX can detect some
common delimiters automatically, such as pipes (|), spaces ( ), commas (,), semicolons (;), etc. The FX cannot
detect tabs (\t) as delimiters automatically, but you can specify them manually in the FX interface.
質問 # 168
Splunkアラートは、run ______の検索に基づくことができます。 （該当するものをすべて選択。）
- A. リアルタイムで
- B. 定期的に
- C. 一致するイベントはありません
正解：A、B
解説：
Splunk alerts can be based on searches that run in real-time or on a regular schedule3. An alert is a way to
monitor your data and get notified when certain conditions are met3. You can create an alert by specifying a
search and a triggering condition3. You can also specify how often you want to run thesearch and how you
want to receive the alert notifications3. You can run the alert search in real-time, which means that it
continuously monitors your data as it streams into Splunk3. Alternatively, you can run the alert search on a
regular schedule, which means that it runs at fixed intervals such as everyhour or every day3. Therefore,
options A and B are correct, while option C is incorrect because it is not a way to run an alert search.
質問 # 169
データモデルとピボットの関係は何ですか？
- A. ピボットとデータモデルは同じものです。
- B. データモデルはピボットのデータセットを提供します。
- C. ピボットとデータモデルには関係がありません。
- D. ピボットはデータモデルのデータセットを提供します。
正解：B
解説：
Explanation
The relationship between data models and pivots is that data models provide the datasets for pivots. Data models are collections of datasets that represent your data in a structured and hierarchical way. Data models define how your data is organized into objects and fields. Pivots are user interfaces that allow you to create data visualizations that present different aspects of a data model. Pivots let you select options from menus and forms to create charts, tables, maps, etc., without writing any SPL code. Pivots use datasets from data models as their source of data. Pivots and data models are not the same thing, as pivots are tools for visualizing data models. Pivots do not provide datasets for data models, but rather use them as inputs.
Therefore, only statement A is true about the relationship between data models and pivots.
質問 # 170
SPL を使用せずにデータ モデルを使用してレポートとダッシュボード パネルを生成するツールはどれですか?
- A. ピボット
- B. データセット
- C. スプランク CIM
- D. 視覚化タブ
正解：A
解説：
The correct answer isB. Pivot1.
In Splunk, Pivot is a tool that uses data models to generate reports and dashboard panels without the need for
users to write or understand Splunk's Search Processing Language (SPL)1.Data models enable users of Pivot
to create compelling reports and dashboards1.When a Pivot user designs a pivot report, they select the data
model that represents the category of event data that they want to work with1.Then they select a dataset within
that data model that represents the specific dataset on which they want to report1.This makes Pivot a powerful
tool for users who need to create visualizations but do not have a deep understanding of SPL1.
質問 # 171
コロプレスマップの場合、splunkには次のKMZファイルが付属しています（該当するものをすべて選択してください）
- A. 世界の国々
- B. 米国およびカナダの州および県
- C. 欧州連合の国
- D. アメリカ合衆国の州
正解：A、D
解説：
Splunk ships with the following KMZ files for choropleth maps: States of the United States and Countries of the World. A KMZ file is a compressed file that contains a KML file and other resources. A KML file is an XML file that defines geographic features and their properties. A KMZ file can be used to create choropleth maps in Splunk by using the geom command. A choropleth map is a type of map that shows geographic regions with different colors based on some metric. Splunk ships with two KMZ files that define the geographic regions for choropleth maps:
States of the United States: This KMZ file defines the 50 states of the United States and their boundaries. The name of this KMZ file is us_states.kmz and it is located in the $SPLUNK_HOME/etc/apps/maps/appserver/static/geo directory.
Countries of the World: This KMZ file defines the countries of the world and their boundaries. The name of this KMZ file is world_countries.kmz and it is located in the $SPLUNK_HOME/etc/apps/maps/appserver/static/geo directory.
Splunk does not ship with KMZ files for States and provinces of the United States and Canada or Countries of the European Union. However, you can create your own KMZ files or download them from external sources and use them in Splunk.
質問 # 172
アラートスロットリングは_______に使用されます。
- A. 重大度を確認します
- B. 検索リクエストを時系列でずらす
- C. アラートで自分自身をスパムするのをやめましょう
- D. 各アラートを確認します
正解：C
質問 # 173
このタブには、特定の検索結果のイベントパターンが表示されます。
- A. パターン
- B. 視覚化
- C. 統計
正解：A
質問 # 174
次の検索では、どのフィールドが X 軸に入力されますか?
インデックス = セキュリティ ソースタイプ = Linux セキュア | アクションごとのタイムチャートのカウント
- A. ソースタイプ
- B. _時間
- C. 時間
- D. アクション
正解：B
解説：
Explanation
The correct answer is C. _time.
The timechart command creates a time series chart with corresponding table of statistics, with time used as the X-axis1. You can specify a split-by field, where each distinct value of the split-by field becomes a series in the chart1. In this case, the split-by field is action, which means that the chart will have different lines for different actions, such as accept, reject, or fail2. The count function will calculate the number of events for each action in each time bin1.
For example, the following image shows a timechart of the count by action for a similar search3:
As you can see, the x-axis is populated by the _time field, which represents the time range of the search. The y-axis is populated by the count function, which represents the number of events for each action. The legend shows the different values of the action field, which are used to split the chart into different series.
Reference:
2: Timechart Command In Splunk With Example - Mindmajix 1: timechart - Splunk Documentation 3:
timechart command examples - Splunk Documentation
質問 # 175
マクロを定義するときに必要な要素は何ですか?
- A. 名前と引数。
- B. 名前と定義。
- C. 定義と引数。
- D. 名前と検証エラー メッセージ。
正解：B
解説：
When defining a search macro, the required elements are the name and the definition of the macro. The name is a unique identifier for the macro that can be used to invoke it in other searches. The definition is the search string that the macro expands to when referenced. The arguments, validation expression, and validation error message are optional elements that can be used to customize the macro behavior and input validation2
1: Splunk Core Certified Power User Track, page 9. 2: Splunk Documentation, Define search macros in Settings.
質問 # 176
次の例のうち、POST ワークフロー アクションを使用するものはどれですか?
- A. イベントで見つかったドメイン値に基づいて外部 IP ルックアップを実行します。
- B. Web ブラウザを開いて HTTP ステータス コードを調べます。
- C. HTTP エラー イベントのフィールド値を使用して、外部システムに新しいチケットを作成します。
- D. 選択したイベントの 1 つ以上のフィールド値を使用するセカンダリ Splunk 検索を起動します。
正解：C
解説：
Explanation
The correct answer is B. Use the field values in an HTTP error event to create a new ticket in an external system.
A workflow action is a knowledge object that enables a variety of interactions between fields in events and other web resources. Workflow actions can create HTML links, generate HTTP POST requests, or launch secondary searches based on field values1.
There are three types of workflow actions that can be set up using Splunk Web: GET, POST, and Search2.
GET workflow actions create typical HTML links to do things like perform Google searches on specific values or run domain name queries against external WHOIS databases2.
POST workflow actions generate an HTTP POST request to a specified URI. This action type enables you to do things like creating entries in external issue management systems using a set of relevant field values2.
Search workflow actions launch secondary searches that use specific field values from an event, such as a search that looks for the occurrence of specific combinations of ipaddress and http_status field values in your index over a specific time range2.
Therefore, the example that would use a POST workflow action is B. Use the field values in an HTTP error event to create a new ticket in an external system. This example requires sending an HTTP POST request to the URI of the external system with the field values from the event as arguments.
The other examples would use different types of workflow actions. These examples are:
A: Perform an external IP lookup based on a domain value found in events: This example would use a GET workflow action to create a link to an external IP lookup service with the domain value as a parameter.
C: Launch secondary Splunk searches that use one or more field values from selected events: This example would use a Search workflow action to run another Splunk search with the field values from the event as search terms.
D: Open a web browser to look up an HTTP status code: This example would also use a GET workflow action to create a link to a web page that explains the meaning of the HTTP status code.
References:
Splexicon:Workflowaction
About workflow actions in Splunk Web
質問 # 177
次のステートメントのどれが以下のコマンドを説明しています（該当するものをすべて選択してください）Sourcetype = access_combined |トランザクションJSESSIONID
- A. eventcountという名前の追加フィールドが作成されます。
- B. durationという名前の追加フィールドが作成されます。
- C. 同じJSESSIONIDを持つイベントは、1つのイベントにグループ化されます。
- D. maxspanという名前の追加のファイルが作成されます。
正解：A、B、C
解説：
Explanation
The command sourcetype=access_combined | transaction JSESSIONID does three things:
It filters the events by the sourcetype access_combined, which is a predefined sourcetype for Apache web server logs.
It groups the events by the field JSESSIONID, which is a unique identifier for each user session.
It creates a single event from each group of events that share the same JSESSIONID value. This single event will have some additional fields created by the transaction command, such as duration, eventcount, and startime.
Therefore, the statements B, C, and D are true.
質問 # 178
少なくとも1つのREJECTイベントを含むトランザクション内のすべての寄与イベントを識別するには、どの構文が正しいですか？
- A. インデックス-メイン|トランザクションセッションID |検索拒否
- B. インデックス=メイン|トランザクションセッションID |そのtransaction = reject
- C. インデックス=メイン|トランザクションセッションID |ここで、transaction = reject ''
- D. インデックス-メイン|トランスセッションIDを拒否します
正解：A
解説：
Explanation
The transaction command is used to group events that share a common value for one or more fields into transactions2. The transaction command assigns a transaction ID to each group of events and creates new fields such as duration, eventcount and eventlist for each transaction2. To identify all of the contributing events within a transaction that contains at least one REJECT event, you can use the following syntax: index=main | transaction sessionid | search REJECT2. This search will first group the events by sessionid, then filter out the transactions that do not contain REJECT in any of their events2. Therefore, option B is correct, while options A, C and D are incorrect because they do not follow the correct syntax for using the transaction command or the search command.
質問 # 179
エクスポート機能を使用すると、検索結果を__________としてエクスポートできます。（該当するものをすべて選択してください）
- A. HTML
- B. Xml
- C. Json
- D. phpファイル
正解：B、C
解説：
Using the export function, you can export search results as XML or JSON2. The export function allows you to save your search results in a structured format that can be used by other applications or tools2. You can use the output_mode parameter to specify whether you want to export your results as XML or JSON2. Therefore, options A and B are correct, while options C and D are incorrect because they are not formats that you can export your search results as.
質問 # 180
次の検索のうち、Privilegedという名前のタグを含むイベントを返すのはどれですか？
- A. tag = Priv *
- B. tag = priv *
- C. tag = Priv
- D. タグ=特権
正解：A
解説：
Explanation
The tag=Priv* search will return events containing a tag named Privileged, as well as any other tag that starts with Priv. The asterisk (*) is a wildcard character that matches zero or more characters. The other searches will not match the exact tag name.
質問 # 181
......
最新のSPLK-1002日本語試験問題集でSplunk試験問題にトレーニング：https://www.jpntest.com/shiken/SPLK-1002J-mondaishu