SPLK-1002 無料問題集「Splunk Core Certified Power User」

（A）eval expression

（B）Delimiters

（C）table extraction

（D）Regular expression

（A）Regular expressions

（B）Fields generated within a search string

（C）Lookup tables

（D）Extracted fields

（A）Select the same time range from the time-range picker.

（B）Select the "Overwrite time range with the original search" checkbox.

（C）Select the "Use the same time range as the search that created the field listing" checkbox.

（D）Set the earliest time to match the original search.

（A）lookup

（B）eval

（C）transaction

（D）stats

（A）Where

（B）Search

（C）Any of the above

（D）If

（A）All events in a transaction must have the same sourcetype.

（B）All events In a transaction must have the same timestamp.

（C）All events in a transaction must be related by one or more fields.

（D）All events in a transaction must have the exact same set of fields.

（A）index or source

（B）sourcetype or host

（C）index or sourcetype

（D）sourcetype or source

（A）parent

（B）extracted

（C）child

（D）event

（A）Countries of the World

（B）States of the United States

（C）States and provinces of the united states and Canada

（D）Countries of the European Union

（A）#

（B）!

（C）*

（D）^

（A）correlate

（B）persist

（C）duplicate

（D）tag

（A）3

（B）5

（C）1

（D）4

（A）Returns the number of credit card transactions found in the event logs.

（B）Separates two events based on one or more values.

（C）Groups a set of transactions based on time.

（D）Creates a single event from a group of events.

（A）Open a web browser to look up an HTTP status code.

（B）Launch secondary Splunk searches that use one or more field values from selected events.

（C）Perform an external IP lookup based on a domain value found in events.

（D）Use the field values in an HTTP error event to create a new ticket in an external system.

（A）POST workflow actions cannot be created on custom sourcetypes.

（B）POST workflow actions can open a web page in either the same window or a new .

（C）POST workflow actions are always encrypted.

（D）POST workflow actions cannot use field values in their URI.

（A）Pivot requires users to input SPL searches on data models.

（B）They are both knowledge objects.

（C）Pivot allows the creation of data visualizations that present different aspects of a data model.

（D）Data models are created out of datasets called pivots.

（A）To automatically add fields at search time using an eval expression rather than manually including an eval command.

（B）To manually add and remove fields at search time related to statistical functions.

（C）To automatically add fields to the index using an eval expression rather than manually including an eval command.

（D）To manually add fields at search time and check for syntax errors.

（A）The Knowledge Manager uses the CIM to create knowledge objects.

（B）CIM can correlate data from different sources.

（C）CIM is an app that can coexist with other apps on a single Splunk deployment.

（D）CIM is a methodology for normalizing data.

（A）NOT

（B）AND

（C）( )

（D）OR