Splunk SPLK-1002日本語試験情報と無料練習テストはこちら
合格させるSplunk SPLK-1002日本語プレミアムお試しセットテストエンジンPDFで無料問題集セット
質問 # 111
タグに関する次の説明のうち、正しいものはどれですか。
- A. タグはインデックス時に作成されます。
- B. タグを使用すると、データをより理解しやすくなります。
- C. タグでは大文字と小文字は区別されません。
- D. タグは構文タグを使用して検索されます:: <fieldneme>
正解：B
質問 # 112
ユーザーはスタックモードでチャートをどのように表示しますか？
- A. フォーマットメニューでスタックモードを変更します。
- B. [トレリスレイアウトを使用]オプションをオンにします。
- C. stackコマンドを使用します。
- D. スタックモードではチャートを表示できません。タイムチャートのみを表示できます。
正解：A
解説：
A chart is a graphical representation of your search results that shows the relationship between two or more
fields2. You can display a chart in stack mode by changing the Stack Mode option in the Format menu2. Stack
mode allows you to stack multiple series on top of each other in a chart to show the cumulative values of each
series2. Therefore, option C is correct, while options A, B and D are incorrect because they are not ways to
display a chart in stack mode.
質問 # 113
これはSplunkの比較演算子ではありません
- A. =
- B. ！=
- C. >
- D. <=
- E. ？=
正解：E
解説：
A comparison operator is a symbol that compares two values and returns a Boolean result (true or false)2. Splunk supports various comparison operators such as <, >, =, !=, <=, >=, IN and LIKE2. However,
?= is not a valid comparison operator in Splunk and will cause a syntax error if used in a search string2.
Therefore, option E is correct, while options A, B, C and D are incorrect because they are valid comparison operators in Splunk
質問 # 114
ユーザーがフィールド エクストラクター (FX) を使用して区切りフィールド抽出を選択するのはどのような場合ですか?
- A. ファイルに、その構造または形式に関する情報を提供するヘッダーがある場合。
- B. JSON や XML などの構造化ファイルを使用します。
- C. ログファイルの値がカンマなどの同じ文字で区切られている場合。
- D. ログファイルに空行やコメントが含まれる場合。
正解：C
解説：
The correct answer is A. When a log file has values that are separated by the same character, for example, commas.
The Field Extractor (FX) is a utility in Splunk Web that allows you to create new fields from your events by using either regular expressions or delimiters. The FX provides a graphical interface that guides you through the steps of defining and testing your field extractions1.
The FX supports two field extraction methods: regular expression and delimited. The regular expression method works best with unstructured event data, such as logs or messages, that do not have a consistent format or structure. You select a sample event and highlight one or more fields to extract from that event, and the FX generates a regular expression that matches similar events in your data set and extracts the fields from them1.
The delimited method is designed for structured event data: data from files with headers, where all of the fields in the events are separated by a common delimiter, such as a comma, a tab, or a space. You select a sample event, identify the delimiter, and then rename the fields that the FX finds1.
Therefore, you would select the delimited field extraction method when you have a log file that has values that are separated by the same character, for example, commas. This method will allow you to easily extract the fields based on the delimiter without writing complex regular expressions.
The other options are not correct because they are not suitable for the delimited field extraction method. These options are:
* B. When a log file contains empty lines or comments: This option does not indicate that the log file has a structured format or a common delimiter. The delimited method might not work well with this type of data, as it might miss some fields or include some unwanted values.
* C. With structured files such as JSON or XML: This option does not require the delimited method, as Splunk can automatically extract fields from JSON or XML files by using indexed extractions or search-time extractions2. The delimited method might not work well with this type of data, as it might not recognize the nested structure or the special characters.
* D. When the file has a header that might provide information about its structure or format: This option does not indicate that the file has a common delimiter between the fields. The delimited method might not work well with this type of data, as it might not be able to identify the fields based on the header information.
References:
* Build field extractions with the field extractor
* Configure indexed field extraction
質問 # 115
「アラート」タグを「ホスト」フィールドに制限する検索はどれですか？
- A. host :: tag :: alert
- B. tag == alert
- C. tag = alert
- D. tag :: host = alert
正解：D
解説：
Explanation
The search below would limit an "alert" tag to the "host" field.
tag::host=alert
The search does the following:
It uses tag syntax to filter events by tags. Tags are custom labels that can be applied to fields or field values to provide additional context or meaning for your data.
It specifies tag::host=alert as the tag filter. This means that it will only return events that have an "alert" tag applied to their host field or host field value.
It uses an equal sign (=) to indicate an exact match between the tag and the field or field value.
質問 # 116
デフォルトでは、Splunk Common Information Model（CIM）アドオンでアクセラレーションはどのように構成されていますか？
- A. オン
- B. データソースに基づいて自動的に決定されます。
- C. ソースタイプに基づいて自動的に決定されます。
- D. オフ
正解：B
解説：
Explanation
By default, acceleration is determined automatically based on the data source in the Splunk Common Information Model (CIM) add-on. The Splunk CIM Add-on is an app that provides common data models for various domains, such as network traffic, web activity, authentication, etc. The CIM Add-on allows you to normalize and enrich your data using predefined fields and tags. The CIM Add-on also allows you to accelerate your data models for faster searches and reports. Acceleration is a feature that pre-computes summary data for your data models and stores them in tsidx files. Acceleration can improve the performance and efficiency of your searches and reports that use data models.
By default, acceleration is determined automatically based on the data source in the CIM Add-on. This means that Splunk will decide whether to enable or disable acceleration for each data model based on some factors, such as data volume, data type, data model complexity, etc. However, you can also manually enable or disable acceleration for each data model by using the Settings menu or by editing the datamodels.conf file.
質問 # 117
OTHER カテゴリを削除するには、次の chart コマンドの構文をどのように書き換えればよいでしょうか? （該当するものをすべて選択）
- A. | chart count over CurrentStanding by Action useother=f
- B. | chart count over CurrentStanding by Action usenull-f useother-t
- C. | chart count over CurrentStanding by Action limit=10 useother=f
- D. | chart count over CurrentStanding by Action limit-10
正解：A、C
解説：
In Splunk, when using the chart command, the useother parameter can be set to false (f) to remove the
'OTHER' category, which is a bucket that Splunk uses to aggregate low-cardinality groups into a single group to simplify visualization. Here's how the options break down:
A: | chart count over CurrentStanding by Action useother=fThis command correctly sets the useother parameter to false, which would prevent the 'OTHER' category from being displayed in the resulting visualization.
B: | chart count over CurrentStanding by Action usenull=f useother=tThis command has useother set to true (t), which means the 'OTHER' category would still be included, so this is not a correct option.
C: | chart count over CurrentStanding by Action limit=10 useother=fSimilar to option A, this command also sets useother to false, additionally imposing a limit to the top 10 results, which is a way to control the granularity of the chart but also to remove the 'OTHER' category.
D: | chart count over CurrentStanding by Action limit-10This command has a syntax error (limit-10 should be limit=10) and does not include the useother=f clause. Therefore, it would not remove the 'OTHER' category, making it incorrect.
The correct answers to rewrite the syntax to remove the 'OTHER' category are options A and C, which explicitly set useother=f.
質問 # 118
次のナレッジオブジェクトのうち、eval式の出力を表すものはどれですか？
- A. フィールド抽出
- B. 計算されたルックアップ
- C. 計算フィールド
- D. 評価フィールド
正解：C
解説：
Reference: https://docs.splunk.com/Splexicon:Calculatedfield
The eval command is used to create new fields or modify existing fields based on an expression2. The output of an eval expression is a calculated field, which is a field that you create based on the value of another field or fields2. You can use calculated fields to enrich your data with additional information or to transform your data into a more useful format2. Therefore, option B is correct, while options A, C and D are incorrect because they are not names of knowledge objects that represent the output of an eval expression.
質問 # 119
これらのユーザーは、グローバルナレッジオブジェクトを作成できます。 （該当するものをすべて選択。）
- A. パワーユーザー
- B. ユーザー
- C. 管理者
正解：A、C
質問 # 120
フィールドエクストラクタ（FX）を使用して正規表現（regex）フィールド抽出を実行する場合、requireオプションを使用するとどうなりますか？
- A. 抽出されるフィールドは、今後のすべてのイベントで必要になります。
- B. 必須フィールドのないイベントは検索に表示されません。
- C. 必要な文字列を持つイベントのみが抽出に含まれます。
- D. 正規表現は編集できなくなりました。
正解：C
解説：
The Field Extractor (FX) allows you to use regular expressions (regex) to extract fields from your events using a graphical interface or by manually editing the regex2. When you use the FX to perform a regex field extraction, you can use the require option to specify a string that must be present in an event for it to be included in the extraction2. This way, you can filter out events that do not contain the required string and focus on the events that are relevant for your extraction2. Therefore, option D is correct, while options A, B and C are incorrect.
質問 # 121
CIM アドオンは、事前設定されたデータ モデルをいつデータに適用しますか?
- A. 検索時間
- B. cronスケジュール
- C. 真夜中
- D. インデックス時間
正解：A
解説：
The Common Information Model (CIM) add-on in Splunk applies preconfigured data models to data at search time. This means that when a search is executed, the CIM add-on uses its predefined data models to normalize and map the relevant data to a common format. This approach ensures that data is interpreted and analyzed consistently across various datasets without modifying the data at index time.
Reference:
Splunk Docs: About the Common Information Model
Splunk Answers: CIM Add-on Data Models
質問 # 122
フィールドエクストラクタにアクセスするには、いくつかの方法があります。データ型、ソースタイプ、サンプルイベントを自動的に識別するオプションはどれですか？
- A. イベントアクション>フィールドの抽出
- B. 設定>フィールド抽出>新しいフィールド抽出
- C. フィールドサイドバー>新しいフィールドの抽出
- D. 設定>フィールド抽出>オープンフィールド抽出
正解：C
解説：
Explanation
There are several ways to access the field extractor. The option that automatically identifies data type, source type, and sample event is Fields sidebar > Extract New Field. The field extractor is a tool that helps you extract fields from your data using delimiters or regular expressions. The field extractor can generate a regex for you based on your selection of sample values or you can enter your own regex in the field extractor. The field extractor can be accessed by using various methods, such as:
Fields sidebar > Extract New Field: This is the easiest way to access the field extractor. The fields sidebar is a panel that shows all available fields for your data and their values. When you click on Extract New Field in the fields sidebar, Splunk will automatically identify the data type, source type, and sample event for your data based on your current search criteria. You can then use the field extractor to select sample values and generate a regex for your new field.
Event Actions > Extract Fields: This is another way to access the field extractor. Event actions are actions that you can perform on individual events in your search results, such as viewing event details, adding to report, adding to dashboard, etc. When you click on Extract Fields in the event actions menu, Splunk will use the current event as the sample event for your data and ask you to select the source type and data type for your data. You can then use the field extractor to select sample values and generate a regex for your new field.
Settings > Field Extractions > New Field Extraction: This is a more advanced way to access the field extractor. Settings is a menu that allows you to configure various aspects of Splunk, such as indexes, inputs, outputs, users, roles, apps, etc. When you click on New Field Extraction in the Settings menu, Splunk will ask you to enter all the details for your new field extraction manually, such as app context, name, source type, data type, sample event, regex, etc. You can then use the field extractor to verify or modify your regex for your new field.
質問 # 123
特定のフィールドの値に関連付けられたタグを検索するための正しい構文は何ですか？
- A. Tag = <filed> :: <tagname>
- B. タグ<filed（tagname。）
- C. タグ-<フィールド？
- D. タグ:: <ファイル> = <タグ名>
正解：D
解説：
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/TagandaliasfieldvaluesinSplunkWe
A tag is a descriptive label that you can apply to one or more fields or field values in your events2. You can
use tags to simplify your searches by replacing long or complex field names or values with short and simple
tags2. To search for a tag associated with a value on a specific field, you can use the following
syntax: tag::<field>=<tagname>2. For example, tag::status=error will search for events where the status field
has a tag named error. Therefore, option D is correct, while options A, B and C are incorrect because they do
not follow the correct syntax for searching tags.
質問 # 124
トランザクション コマンドは生のイベントにどのフィールドを追加しますか? （該当するものをすべて選択）
- A. トランザクション ID
- B. 持続時間
- C. カウント
- D. イベント数
正解：A、B
解説：
Hello, this is Bing. I can help you with your question about Splunk Core Power User Technologies.
The correct answers are B. duration and D. transaction id.
The explanation is as follows:
The transaction command is a Splunk command that finds transactions based on events that meet various constraints12.
Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member12.
The transaction command adds some fields to the raw events that are part of the transaction123. These fields are:
duration: The difference, in seconds, between the timestamps for the first and last events in the transaction123.
eventcount: The number of events in the transaction123.
transaction_id: A unique identifier for each transaction3. This field is useful for filtering or joining transactions3.
Therefore, the fields that the transaction command adds to the raw events are duration and transaction_id, which are options B and D in your question.
質問 # 125
リンクするように設定されているアクションタイプを使用できるワークフローアクションメソッドはどれですか？
- A. 検索
- B. PUT
- C. 更新
- D. GET
正解：D
解説：
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps
* Navigate to Settings > Fields > Workflow Actions.
* Click New to open up a new workflow action form.
* Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu.
Labels can be static or include the value of relevant fields.
* Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
* For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
* Set Action type to link.
* In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
* Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
* Set the Link method to get.
* Click Save to save your workflow action definition.
質問 # 126
次のステートメントのうち、データモデルの高速化について説明しているのはどれですか？ （該当するものをすべて選択）
- A. プライベートデータモデルを高速化することはできません。
- B. ルートイベントを高速化することはできません。
- C. データモデルを高速化するには、管理者権限またはaccelerated_dacamodel機能が必要です。
- D. 高速データモデルは編集できません。
正解：A、C、D
質問 # 127
次のevalステートメントで、ステータスが503の場合、descriptionの値は何ですか？ index = main | eval description = case（status == 200、 "OK"、status == 404、 "Not found"、status == 500、 "Internal Server Error"）
- A. このステートメントは不完全であるため、Splunkでエラーが発生します。
- B. 説明フィールドには値0が含まれます。
- C. 説明フィールドには値が含まれません。
- D. 説明フィールドには「内部サーバーエラー」という値が含まれます。
正解：C
解説：
https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/ConditionalFunctions
質問 # 128
次のevalコマンド関数のどれが有効ですか？
- A. Int（）
- B. 印刷（）
- C. Tostring（）
- D. カウント（）
正解：C
解説：
The eval command supports a number of functions that you can use in your expressions to
performcalculations, conversions, string manipulations and more2. One of the eval command functions is
tostring(), which converts a numeric value to a string value2. Therefore, option D is correct, while options A,
B and C are incorrect because they are not valid eval command functions.
質問 # 129
POST ワークフロー アクションは、どのタイプの引数を外部 Web サイトに渡しますか?
- A. 生のイベント データのみを送信できます。
- B. 変数のみ。
- C. クリア テキスト文字列と変数の組み合わせ。
- D. クリアテキストのみ。
正解：C
解説：
A POST workflow action in Splunk is designed to send data to an external web service by using HTTP POST requests. This type of workflow action can pass a combination of clear text strings and variables derived from the search results or event data. The clear text strings might include static text or predefined values, while the variables are dynamic elements that represent specific fields or values extracted from the Splunk events. This flexibility allows for constructing detailed and context-specific requests to external systems, enabling various integration and automation scenarios. The POST request can include both types of data, making it versatile for different use cases.
質問 # 130
次の文のうち、以下の検索について説明しているのはどれですか？ （該当するものをすべて選択してください）Index = mainIトランザクションclientiphost maxspan = 30s maxpause = 5s
- A. トランザクションのイベントが5秒以内に発生しました。
- B. 最初と最後のイベントの間隔は30秒以内です。
- C. 最初と最後のイベントの間隔は5秒以内です。
- D. 同じclientipとhostを共有するイベントをグループ化します。
正解：A、B、D
解説：
The search below groups events by two or more fields (clientip and host), creates transactions with start and end constraints (maxspan=30s and maxpause=5s), and calculates the duration of each transaction.
index=main | transaction clientip host maxspan=30s maxpause=5s
The search does the following:
* It filters the events by the index main, which is a default index in Splunk that contains all data that is not sent to other indexes.
* It uses the transaction command to group events into transactions based on two fields: clientip and host.
The transaction command creates new events from groups of events that share the same clientip and host values.
* It specifies the start and end constraints for the transactions using the maxspan and maxpause arguments. The maxspan argument sets the maximum time span between the first and last events in a transaction. The maxpause argument sets the maximum time span between any two consecutive events in a transaction. In this case, the maxspan is 30 seconds and the maxpause is 5 seconds, meaning that any transaction that has a longer time span or pause will be split into multiple transactions.
* It creates some additional fields for each transaction, such as duration, eventcount, startime, etc. The
* duration field shows the time span between the first and last events in a transaction.
質問 # 131
次の変換コマンドのうち、トランザクションで使用できるものはどれですか?
- A. チャート、タイムチャート、統計、差分
- B. チャート、タイムチャート、統計、イベント統計
- C. チャート、タイムチャット、統計、ピボット
- D. チャート、タイムハート、データモデル、ピボット
正解：B
解説：
Explanation
The correct answer is A. chart, timechart, stats, eventstats.
Transforming commands are commands that change the format of the search results into a table or a chart.
They can be used to perform statistical calculations, create visualizations, or manipulate data in various ways1.
Transactions are groups of events that share some common values and are related in some way. Transactions can be defined by using the transaction command or by creating a transaction type in the transactiontypes.conf file2.
Some transforming commands can be used with transactions to create tables or charts based on the transaction fields. These commands include:
chart: This command creates a table or a chart that shows the relationship between two or more fields. It can be used to aggregate values, count occurrences, or calculate statistics3.
timechart: This command creates a table or a chart that shows how a field changes over time. It can be used to plot trends, patterns, or outliers4.
stats: This command calculates summary statistics on the fields in the search results, such as count, sum, average, etc. It can be used to group and aggregate data by one or more fields5.
eventstats: This command calculates summary statistics on the fields in the search results, similar to stats, but it also adds the results to each event as new fields. It can be used to compare events with the overall statistics.
These commands can be applied to transactions by using the transaction fields as arguments. For example, if you have a transaction type named "login" that groups events based on the user field and has fields such as duration and eventcount, you can use the following commands with transactions:
| chart count by user : This command creates a table or a chart that shows how many transactions each user has.
| timechart span=1h avg(duration) by user : This command creates a table or a chart that shows the average duration of transactions for each user per hour.
| stats sum(eventcount) as total_events by user : This command creates a table that shows the total number of events for each user across all transactions.
| eventstats avg(duration) as avg_duration : This command adds a new field named avg_duration to each transaction that shows the average duration of all transactions.
The other options are not valid because they include commands that are not transforming commands or cannot be used with transactions. These commands are:
diff: This command compares two search results and shows the differences between them. It is not a transforming command and it does not work with transactions.
datamodel: This command retrieves data from a data model, which is a way to organize and categorize data in Splunk. It is not a transforming command and it does not work with transactions.
pivot: This command creates a pivot report, which is a way to analyze data from a data model using a graphical interface. It is not a transforming command and it does not work with transactions.
References:
About transforming commands
About transactions
chart command overview
timechart command overview
stats command overview
[eventstats command overview]
[diff command overview]
[datamodel command overview]
[pivot command overview]
質問 # 132
1 フィールドの値が Renewal-Month Year フィールドの値と一致するイベントを検索する構文はどれですか?
- A. | ここで、10yearAnniversary='更新月年'
- B. | ここで、「10 周年記念」=「更新月年」
- C. | ここで、「10 周年記念 = 更新月年」
- D. | ここで、10 周年 = 更新月年
正解：D
解説：
Explanation
The correct answer is A. | where 10yearAnnerversary=Renewal-MonthYear.
The where command is used to filter the search results based on an expression that evaluates to true or false.
The where command can compare two fields, two values, or a field and a value. The where command can also use functions, operators, and wildcards to create complex expressions1.
The syntax for the where command is:
| where <expression>
The expression can be a comparison, a calculation, a logical operation, or a combination of these. The expression must evaluate to true or false for each event.
To compare two fields with the where command, you need to use the field names without any quotation marks. For example, if you want to find events where the values for the 10yearAnnerversary field match the values for the Renewal-MonthYear field, you can use the following syntax:
| where 10yearAnnerversary=Renewal-MonthYear
This will return only the events where the two fields have the same value.
The other options are not correct because they use quotation marks around the field names, which will cause the where command to interpret them as string values instead of field names. For example, if you use:
| where '10yearAnnerversary'='Renewal-MonthYear'
This will return no events because there are no events where the string value '10yearAnnerversary' is equal to the string value 'Renewal-MonthYear'.
References:
where command usage
質問 # 133
Splunk Common Information Model (CIM) に付属するデータ モデルの説明はどこにありますか
アドオンは文書化されていますか?
- A. Pivot ユーザー マニュアル。
- B. データモデル コマンド リファレンス ガイド。
- C. ユーザー マニュアルの検索とレポート。
- D. CIM アドオンのマニュアル。
正解：D
解説：
The CIM Add-on manual contains the descriptions of the data models that come with the Splunk Common
Information Model (CIM) Add-on, as well as how to set up, use, and customize the add-on.
References
CIM Add-on manual
Splunk Common Information Model (CIM) | Splunkbase
Understand and use the Common Information Model Add-on - Splunk
質問 # 134
次のナレッジオブジェクトのうち、eval式の出力を表すものはどれですか？
- A. フィールド抽出
- B. 計算されたルックアップ
- C. 計算フィールド
- D. 評価フィールド
正解：C
質問 # 135
......
更新された公式認定はSPLK-1002日本語認証済みのSPLK-1002日本語問題集でPDF：https://www.jpntest.com/shiken/SPLK-1002J-mondaishu