2023年最新の実際のSPLK-1002問題集最新Splunk練習テスト問題集ゲット
SPLK-1002問題集PDFでSPLK-1002リアル試験問題解答
SPLK-1002認定試験は、60の複数選択の質問で構成されるオンラインで提示された試験です。候補者は試験を完了するのに90分かかり、合格するには70％以上を獲得する必要があります。この試験は、信頼できるインターネット接続を備えた場所からいつでも撮影でき、忙しい専門家にとって便利です。
Splunk SPLK-1002試験は、データ分析と視覚化のためにSplunkを使用する専門知識を実証したい個人向けに設計されています。この認定は、Splunk Coreを使用するスキルを紹介したいパワーユーザー、管理者、および開発者に適しています。この試験では、検索とレポート、知識オブジェクト、データ管理など、さまざまなトピックをカバーしています。
質問 # 35
Which delimiters can the Field Extractor (FX) detect? (select all that apply)
- A. Commas
- B. Spaces
- C. Tabs
- D. Pipes
正解：A、B、C、D
質問 # 36
These kinds of charts represent a series in a single bar with multiple sections
- A. Omit nulls
- B. Stacked
- C. Multi-Series
- D. Split-Series
正解：B
解説：
Stacked charts represent a series in a single bar with multiple sections. A chart is a graphical representation of data that shows trends, patterns, or comparisons. A chart can have different types, such as column, bar, line, area, pie, etc. A chart can also have different modes, such as split-series, multi-series, stacked, etc. A stacked chart is a type of chart that shows multiple series in a single bar or area with different sections for each series
質問 # 37
During the validation step of the Field Extractor workflow:
Select your answer.
- A. You can validate where the data originated from
- B. You cannot modify the field extraction
- C. You can remove values that aren't a match for the field you want to define
正解：C
質問 # 38
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search
- A. Events will be returned from the data model named Application_State.
- B. No events will be returned because the pipe should occur after the datamodel command
- C. Events will be returned from dataset named Application_state.
- D. Events will be returned from the data model named All_Application_state.
正解：A
質問 # 39
Which of the following searches will show the number of categoryld used by each host?
- A. Sourcetype=access_* |sum bytes by host
- B. Sourcetype=access_* |sum(bytes) by host
- C. Sourcetype=access_* |stats sum(categorylD. by host
- D. Sourcetype=access_* |stats sum by host
正解：C
質問 # 40
Fast, optimized and verbose are all selectable search modes.
- A. True
- B. False
正解：B
質問 # 41
The time range specified for a historical search defines the ____________ .------questionable on ans
- A. Amount of data shown on the timeline as data streams in
- B. Amount of data fetched from index matching that time range
- C. Time range for the static results
正解：B
解説：
The time range specified for a historical search defines the amount of data fetched from the index matching that time range2. A historical search is a search that runs over a fixed period of time in the past2. When you run a historical search, Splunk searches the index for events that match your search string and fall within the specified time range2. Therefore, option B is correct, while options A and C are incorrect because they are not what the time range defines for a historical search.
質問 # 42
Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status
- A. returns a table with 3 columns
- B. limits the fields are extracted
- C. is looking for all events that include the search terms: fields AND action AND productld AND status
- D. users the table command to improve performance
正解：B
質問 # 43
Which of the following knowledge objects represents the output of an eval expression?
- A. Eval fields
- B. Calculated lookups
- C. Field extractions
- D. Calculated fields
正解：D
解説：
Reference: https://docs.splunk.com/Splexicon:Calculatedfield
The eval command is used to create new fields or modify existing fields based on an expression2. The output of an eval expression is a calculated field, which is a field that you create based on the value of another field or fields2. You can use calculated fields to enrich your data with additional information or to transform your data into a more useful format2. Therefore, option B is correct, while options A, C and D are incorrect because they are not names of knowledge objects that represent the output of an eval expression.
質問 # 44
Based on the macro definition shown below, what is the correct way to execute the macro in a search string?
- A. Convert_sales (euro, €, 79)"
- B. Convert_sales (euro, €, .79)
- C. Convert_sales ($euro, $€$,S,79$)
- D. Convert_sales ($euro,$€$,s79$
正解：C
解説：
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Usesearchmacros
質問 # 45
Only Splunk Administrators can assign selected fields.
- A. True
- B. False
正解：B
質問 # 46
Which of the following searches show a valid use of macro? (Select all that apply)
- A. Option B
- B. Option A
- C. Option D
- D. Option C
正解：B、D
質問 # 47
If a search returns ____________ it can be viewed as a chart.
- A. statistics
- B. timestamps
- C. events
- D. keywords
正解：A
解説：
If a search returns statistics, it can be viewed as a chart2. Statistics are tabular data that show the relationship between two or more fields2. You can create statistics by using commands such as stats, chart or timechart2. You can view statistics as a chart by selecting the Visualization tab in the Search app and choosing a chart type such as column, line or pie2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of data that can be viewed as a chart.
質問 # 48
When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?
- A. Weight
- B. Rank
- C. Priority
- D. Precedence
正解：C
質問 # 49
Which of the following actions can the eval command perform?
- A. Save SPL commands to be reused in other searches.
- B. Remove fields from results.
- C. Create or replace an existing field.
- D. Group transactions by one or more fields.
正解：C
質問 # 50
When using | timechart by host, which field is represented in the x-axis?
- A. date
- B. _time
- C. host
- D. time
正解：B
質問 # 51
Alert throttling is used to _______.
- A. verify each alert
- B. check severity
- C. stagger search request in a time sequenced order
- D. stop spamming yourself with alerts
正解：D
質問 # 52
Which statement is true?
- A. Pivot is used for creating reports and dashboards.
- B. Pivot is used for creating datasets.
- C. In most cases, each Splunk user will create their own data model.
- D. Data model are randomly structured datasets.
正解：A
質問 # 53
What is a limitation of searches generated by workflow actions?
- A. Searches generated by workflow action run with the same permissions as the user running them.
- B. Searches generated by workflow action must run in the same app as the workflow action.
- C. Searches generated by workflow action cannot use macros.
- D. Searches generated by workflow actions must be less than 256 characters long.
正解：A
質問 # 54
To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?
- A. Index-main | transaction sessionid | search REJECT
- B. Index-main | REJECT trans sessionid
- C. Index=main | transaction sessionid | where transaction=reject''
- D. Index=main | transaction sessionid | whose transaction=reject
正解：D
質問 # 55
For choropleth maps,splunk ships with the following KMZ files (select all that apply)
- A. States of the United States
- B. Countries of the European Union
- C. Countries of the World
- D. States and provinces of the united states and Canada
正解：A、C
解説：
Explanation
Splunk ships with the following KMZ files for choropleth maps: States of the United States and Countries of the World. A KMZ file is a compressed file that contains a KML file and other resources. A KML file is an XML file that defines geographic features and their properties. A KMZ file can be used to create choropleth maps in Splunk by using the geom command. A choropleth map is a type of map that shows geographic regions with different colors based on some metric. Splunk ships with two KMZ files that define the geographic regions for choropleth maps:
States of the United States: This KMZ file defines the 50 states of the United States and their boundaries. The name of this KMZ file is us_states.kmz and it is located in the
$SPLUNK_HOME/etc/apps/maps/appserver/static/geo directory.
Countries of the World: This KMZ file defines the countries of the world and their boundaries. The name of this KMZ file is world_countries.kmz and it is located in the
$SPLUNK_HOME/etc/apps/maps/appserver/static/geo directory.
Splunk does not ship with KMZ files for States and provinces of the United States and Canada or Countries of the European Union. However, you can create your own KMZ files or download them from external sources and use them in Splunk.
質問 # 56
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)
- A. Colons
- B. Spaces
- C. Tabs
- D. Pipes
正解：B、C、D
質問 # 57
......
SPLK-1002プレミアム試験エンジンPDFをダウンロード：https://www.jpntest.com/shiken/SPLK-1002-mondaishu