Month End Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: cramtick70

SPLK-1002 Splunk Core Certified Power User Exam Questions and Answers

Questions 4

What information must be included when using the datamodel command?

Options:

A.

status field

B.

Multiple indexes

C.

Data model field name.

D.

Data model dataset name.

Buy Now
Questions 5

When should the delimiter method be used in the Field Extractor?

Options:

A.

When the events do not have the correct permissions set.

B.

When the events are separated by a consistent character or set of characters.

C.

When the events need a regular expression to define the matching pattern.

D.

When the events need to be calculated using special characters.

Buy Now
Questions 6

Which are valid ways to create an event type? (select all that apply)

Options:

A.

By using the searchtypes command in the search bar.

B.

By editing the event_type stanza in the props.conf file.

C.

By going to the Settings menu and clicking Event Types > New.

D.

By selecting an event in search results and clicking Event Actions > Build Event Type.

Buy Now
Questions 7

How are arguments defined within the macro search string?

Options:

A.

Şarg$

B.

'arg'

C.

%arg%

D.

"arg"

Buy Now
Questions 8

What does the transaction command do?

Options:

A.

Groups a set of transactions based on time.

B.

Creates a single event from a group of events.

C.

Separates two events based on one or more values.

D.

Returns the number of credit card transactions found in the event logs.

Buy Now
Questions 9

Which of the following statements is true, especially in large environments?

Options:

A.

Use the scats command when you next to group events by two or more fields.

B.

The stats command is faster and more efficient than the transaction command

C.

The transaction command is faster and more efficient than the stats command.

D.

Use the transaction command when you want to see the results of a calculation.

Buy Now
Questions 10

Which of the following can be saved as an event type?

Options:

A.

index=server_48 sourcetype=BETA_881 code=220

B.

index=server_48 sourcetype=BETA_881 code=220 | stats count by code

C.

index=server_48 sourcetype=BETA_881 code=220 | inputlookup append=t servercode.csv

D.

index=server_48 sourcetype=BETA_881 code=220 | stats where code > 220

Buy Now
Questions 11

When using the transaction command, what is the assigned timestamp for each of the resulting transactions?

Options:

A.

The timestamp of the event search time execution.

B.

The timestamp of the earliest event.

C.

The difference between the earliest and latest event.

D.

The timestamp of the most recent event.

Buy Now
Questions 12

Why are tags useful in Splunk?

Options:

A.

Tags look for less specific data.

B.

Tags visualize data with graphs and charts.

C.

Tags group related data together.

D.

Tags add fields to the raw event data.

Buy Now
Questions 13

Which of the following statements is true about the root dataset of a data model?

Options:

A.

It can contain transforming commands as long as it is a root search dataset.

B.

It will automatically contain knowledge objects associated with the base search.

C.

It must contain the transaction command if it is a root transaction dataset.

D.

It can only contain a base search with no transforming commands.

Buy Now
Questions 14

Consider the following search:

index=web sourcetype=access_combined

The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group.

From the following list, which search groups events by JSESSIONID?

Options:

A.

index=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117

B.

index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117

C.

index=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID

D.

index=web sourcetype=access_combined JSESSIONID

Buy Now
Questions 15

Which of the following definitions describes a macro named "samplemacro" that accepts two arguments?

Options:

A.

samplemacro[2]

B.

samplemacro[1,2]

C.

samplemacro(2)

D.

samplemacro(1,2)

Buy Now
Questions 16

Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Options:

A.

inputlookup

B.

lookup

Buy Now
Questions 17

What commands can be used to group events from one or more data sources?

Options:

A.

eval, coalesce

B.

transaction, stats

C.

stats, format

D.

top, rare

Buy Now
Questions 18

During the validation step of the Field Extractor workflow:

Select your answer.

Options:

A.

You can remove values that aren't a match for the field you want to define

B.

You can validate where the data originated from

C.

You cannot modify the field extraction

Buy Now
Questions 19

Which of the following data models are included in the Splunk Common Information Model (CIM) add-on? (select all that apply)

Options:

A.

User permissions

B.

Alerts

C.

Databases

D.

Email

Buy Now
Questions 20

What is a benefit of installing the Splunk Common Information Model (CIM) add-on?

Options:

A.

It permits users to create workflow actions to align with industry standards.

B.

It provides users with a standardized set of field names and tags to normalize data.

C.

It allows users to create 3-D models of their data and export these visualizations.

D.

It enables users to itemize their events based on the results of the Search Job Inspector.

Buy Now
Questions 21

When using the Field Extractor (FX) to perform a field extraction, which delimiter can be used?

Options:

A.

A period or comma.

B.

A comma.

C.

A tab or space.

D.

Any consistent character.

Buy Now
Questions 22

Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

Options:

A.

maxpause

B.

endswith

C.

maxduration

D.

maxspan

Buy Now
Questions 23

Which of the following searches will return events contains a tag name Privileged?

Options:

A.

Tag= Priv

B.

Tag= Pri*

C.

Tag= Priv*

D.

Tag= Privileged

Buy Now
Questions 24

When would a user select delimited field extractions using the Field Extractor (FX)?

Options:

A.

When a log file has values that are separated by the same character, for example, commas.

B.

When a log file contains empty lines or comments.

C.

With structured files such as JSON or XML.

D.

When the file has a header that might provide information about its structure or format.

Buy Now
Questions 25

Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

Options:

A.

Field alias

B.

Event types

C.

Search workflow action

D.

Tags

Buy Now
Questions 26

What is the relationship between data models and pivots?

Options:

A.

Data models provide the datasets for pivots.

B.

Pivots and data models have no relationship.

C.

Pivots and data models are the same thing.

D.

Pivots provide the datasets for data models.

Buy Now
Questions 27

When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied. (Select all that apply).

Options:

A.

OR

B.

( )

C.

AND

D.

NOT

Buy Now
Questions 28

What do events in a transaction have In common?

Options:

A.

All events In a transaction must have the same timestamp.

B.

All events in a transaction must have the same sourcetype.

C.

All events in a transaction must have the exact same set of fields.

D.

All events in a transaction must be related by one or more fields.

Buy Now
Questions 29

If there are fields in the data with values that are " " or empty but not null, which of the following would add a value?

Options:

A.

| eval notNULL = if(isnull (notNULL), “0” notNULL)

B.

| eval notNULL = if(isnull (notNULL), “0”

C.

| eval notNULL = “” | nullfill value=0 notNULL

D.

| eval notNULL = “” fillnull value=0 notNULL

Buy Now
Questions 30

Which group of users would most likely use pivots?

Options:

A.

Users

B.

Architects

C.

Administrators

D.

Knowledge Managers

Buy Now
Questions 31

We can use the rename command to _____ (Select all that apply.)

Options:

A.

Change indexed fields

B.

Exclude fields from our search results

C.

Extract new fields from our data using regular expressions

D.

Give a field a new name at search time

Buy Now
Questions 32

A user wants to create a new field alias for a field that appears in two sourcetypes.

How many field aliases need to be created?

Options:

A.

One.

B.

Two.

C.

It depends on whether the original fields have the same name.

D.

It depends on whether the two sourcetypes are associated with the same index.

Buy Now
Questions 33

What are search macros?

Options:

A.

Lookup definitions in lookup tables.

B.

Reusable pieces of search processing language.

C.

A method to normalize fields.

D.

Categories of search results.

Buy Now
Questions 34

Which of these is NOT a field that is automatically created with the transaction command?

Options:

A.

maxcount

B.

duration

C.

eventcount

Buy Now
Questions 35

Which of the following statements about tags is true?

Options:

A.

Tags are case insensitive.

B.

Tags are created at index time.

C.

Tags can make your data more understandable.

D.

Tags are searched by using the syntax tag: :

Buy Now
Questions 36

Which of the following statements describes the use of the Filed Extractor (FX)?

Options:

A.

The Field Extractor automatically extracts all field at search time.

B.

The Field Extractor uses PERL to extract field from the raw events.

C.

Field extracted using the Extracted persist as knowledge objects.

D.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

Buy Now
Questions 37

When using | timechart by host, which field is represented in the x-axis?

Options:

A.

date

B.

host

C.

time

D.

_time

Buy Now
Questions 38

What are the expected search results from executing the following SPL command?

index=network NOT StatusCode=200

Options:

A.

Every event in the network index that does not have a value in this field.

B.

Every event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.

C.

Every event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.

D.

No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.

Buy Now
Questions 39

Which of the following is NOT a stats function:

Options:

A.

sum

B.

addtotals

C.

count

D.

avg

Buy Now
Questions 40

When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Options:

A.

Tabs

B.

Pipes

C.

Colons

D.

Spaces

Buy Now
Questions 41

What is the correct Boolean order of evaluation for the where command from first to last?

Options:

A.

NOT, Parentheses, OR, AND

B.

AND, Parentheses, NOT, OR

C.

Parentheses, NOT, AND, OR

D.

Parentheses, NOT, OR, AND

Buy Now
Questions 42

Which of the following describes this search?

New Search

'third_party_outages(EMEA,-24h)'

Options:

A.

This search will find all events for the third_party_outages event type that have "EMEA" or "-24h" in the raw event data.

B.

This search will run the third_party_outages saved search and filter for events containing "EMEA" and "-24h" in the raw event data.

C.

This search will run the third_party_outages macro and pass the arguments EMEA and -24h to the macro definition.

D.

This search will find all events in the third_party_outages index with the tags EMEA and -24h.

Buy Now
Questions 43

If a calculated field has the same name as an extracted field, what happens to the extracted field?

Options:

A.

The calculated field will override the extracted field.

B.

The calculated and extracted fields will be combined.

C.

The calculated field will duplicate the extracted field.

D.

An error will be returned and the search will fail.

Buy Now
Questions 44

What are the expected results for a search that contains the command | where A=B?

Options:

A.

Events that contain the string value where A=B.

B.

Events that contain the string value A=B.

C.

Events where values of field are equal to values of field B.

D.

Events where field A contains the string value B.

Buy Now
Questions 45

Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Options:

A.

is looking for all events that include the search terms: fields AND action AND productld AND status

B.

users the table command to improve performance

C.

limits the fields are extracted

D.

returns a table with 3 columns

Buy Now
Questions 46

Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

Options:

A.

POST

B.

Search

C.

GET

D.

Format

Buy Now
Questions 47

These kinds of charts represent a series in a single bar with multiple sections

Options:

A.

Multi-Series

B.

Split-Series

C.

Omit nulls

D.

Stacked

Buy Now
Questions 48

What does the fillnull command do in this search?

index=main sourcetype=http:log | fillnull value="Unknown" src

Options:

A.

Set the values of the src field to null when it is "Unknown".

B.

Set all fields that are null to "Unknown".

C.

Set the values of the src field to "Unknown" if it is null.

D.

Set all fields with the value of "Unknown" to null.

Buy Now
Questions 49

What fields does the transaction command add to the raw events? (select all that apply)

Options:

A.

count

B.

duration

C.

eventcount

D.

transaction id

Buy Now
Questions 50

Which syntax is used to represent an argument in a macro definition?

Options:

A.

"argument"

B.

%argument%

C.

‘argument’

D.

$argument$

Buy Now
Questions 51

Which of the following expressions could be used to create a calculated field called gigabytes?

Options:

A.

eval sc_bytes(1024/1024)

B.

| eval negabytes=sc_bytes(1024/1024)

C.

megabytes=sc_bytes(1024/1024)

D.

sc_bytas(1024/1024)

Buy Now
Questions 52

Calculated fields can be based on which of the following?

Options:

A.

Tags

B.

Extracted fields

C.

Output fields for a lookup

D.

Fields generated from a search string

Buy Now
Questions 53

A macro has another macro nested within it, and this inner macro requires an argument. How can the user pass this argument into the SPL?

Options:

A.

An argument can be passed through the outer macro.

B.

An argument can be passed to the outer macro by nesting parentheses.

C.

There is no way to pass an argument to the inner macro.

D.

An argument can be passed to the inner macro by nesting parentheses.

Buy Now
Questions 54

In which of the following scenarios is an event type more effective than a saved search?

Options:

A.

When a search should always include the same time range.

B.

When a search needs to be added to other users' dashboards.

C.

When the search string needs to be used in future searches.

D.

When formatting needs to be included with the search string.

Buy Now
Questions 55

Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

Options:

A.

Macros

B.

Lookups

C.

Workflow actions

D.

Field extractions

Buy Now
Questions 56

This is what Splunk uses to categorize the data that is being indexed.

Options:

A.

Host

B.

Sourcetype

C.

Index

D.

Source

Buy Now
Questions 57

Which option of the transaction command would be used to specify the maximum time between events in a transaction?

Options:

A.

maxpause

B.

maxspan

C.

duration

D.

 eventcount

Buy Now
Questions 58

Which of the following actions can the eval command perform?

Options:

A.

Remove fields from results.

B.

Create or replace an existing field.

C.

Group transactions by one or more fields.

D.

Save SPL commands to be reused in other searches.

Buy Now
Questions 59

What are the two parts of a root event dataset?

Options:

A.

Fields and variables.

B.

Fields and attributes.

C.

Constraints and fields.

D.

Constraints and lookups.

Buy Now
Questions 60

A data model can consist of what three types of datasets?

Options:

A.

Pivot, searches, and events.

B.

Pivot, events, and transactions.

C.

Searches, transactions, and pivot.

D.

Events, searches, and transactions.

Buy Now
Questions 61

What is the correct format for naming a macro with multiple arguments?

Options:

A.

monthly_sales(argument 1, argument 2, argument 3)

B.

monthly_sales(3)

C.

monthly_sales[3]

D.

monthly_sales[argument 1, argument 2, argument 3)

Buy Now
Questions 62

Which of the following workflow actions can be executed from search results? (select all that apply)

Options:

A.

GET

B.

POST

C.

LOOKUP

D.

Search

Buy Now
Questions 63

For the following search, which command would further filter for only IP addresses present more than five times?

Options:

A.

index=games I stats count as IP_count by IP B. | where IP_count > 5

B.

index=games | search IP_Count > 5

C.

index=games | where IP > 5

D.

index=games I search IP > 5

Buy Now
Questions 64

What is the correct syntax to search for a tag associated with a value on a specific fields?

Options:

A.

Tag-

B.

Tag

C.

Tag=::

D.

Tag::=

Buy Now
Questions 65

What does the fillnull command replace null values with, it the value argument is not specified?

Options:

A.

0

B.

N/A

C.

NaN

D.

NULL

Buy Now
Questions 66

Which of the following is included with the Splunk Common Information Model (CIM) Add-on?

Options:

A.

Sourcetype definitions from the most popular technology vendors.

B.

A set of pre-configured data models.

C.

Scripted inputs to pre-align data with the CIM.

D.

Dashboards to validate data quality.

Buy Now
Questions 67

A field alias is created where field1—fieid2 and the Overwrite Field Values checkbox is selected.

What happens if an event only contains values for fieid1?

Options:

A.

field2 values are removed from the events.

B.

field1 and field2 values are merged.

C.

field2 values are unchanged.

D.

field2 values are replaced with the value of the field1.

Buy Now
Questions 68

Selected fields are displayed ______each event in the search results.

Options:

A.

below

B.

interesting fields

C.

other fields

D.

above

Buy Now
Questions 69

The fields sidebar does not show________. (Select all that apply.)

Options:

A.

interesting fields

B.

selected fields

C.

all extracted fields

Buy Now
Questions 70

When using the timechart command, how can a user group the events into buckets based on time?

Options:

A.

Using the span argument.

B.

Using the duration argument.

C.

Using the interval argument.

D.

Adjusting the fieldformat options.

Buy Now
Questions 71

This function of the stats command allows you to return the middle-most value of field X.

Options:

A.

Median(X)

B.

Eval by X

C.

Fields(X)

D.

Values(X)

Buy Now
Questions 72

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Options:

A.

The regex can no longer be edited.

B.

The field being extracted will be required for all future events.

C.

The events without the required field will not display in searches.

D.

Only events with the required string will be included in the extraction.

Buy Now
Questions 73

Which of the following statements about calculated fields in Splunk is true?

Options:

A.

Calculated fields cannot be chained together to create more complex fields

B.

Calculated fields can be chained together to create more complex fields.

C.

Calculated fields can only be used in dashboards.

D.

Calculated fields can only be used in saved reports.

Buy Now
Questions 74

Which of the following eval commands will provide a new value for host from src if it exists?

Options:

A.

| eval host = if (isnu11 (src), src, host)

B.

| eval host = if (NOT src = host, src, host)

C.

| eval host = if (src = host, src, host)

D.

| eval host = if (isnotnull (src), src, host)

Buy Now
Questions 75

Which of the following commands support the same set of functions?

Options:

A.

stats, eval, table

B.

search, where, eval

C.

stats, chart, timechart

D.

transaction, chart, timechart

Buy Now
Questions 76

Two separate results tables are being combined using the join command. The outer table has the following values:

The inner table has the following values:

The line of SPL used to join the tables is: join employeeNumber type=outer

How many rows are returned in the new table?

Options:

A.

Three

B.

Eight

C.

Five

D.

Zero

Buy Now
Questions 77

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Options:

A.

Tabs

B.

Pipes

C.

Spaces

D.

Commas

Buy Now
Questions 78

Which of the following eval command functions is valid?

Options:

A.

int()

B.

count()

C.

print()

D.

tostring()

Buy Now
Questions 79

A calculated field may be based on which of the following?

Options:

A.

Fields generated within a search string

B.

Lookup tables

C.

Regular expressions

D.

Extracted fields

Buy Now
Questions 80

Which of the following about reports is/are true?

Options:

A.

Reports are knowledge objects.

B.

Reports can be scheduled.

C.

Reports can run a script.

D.

All of the above.

Buy Now
Questions 81

Which of the following is true about the Splunk Common Information Model (CIM)?

Options:

A.

The data models included in the CIM are configured with data model acceleration turned off.

B.

The CIM contains 28 pre-configured datasets.

C.

The CIM is an app that needs to run on the indexer.

D.

The data models included in the CIM are configured with data model acceleration turned on.

Buy Now
Questions 82

Field aliases are used to __________ data

Options:

A.

clean

B.

transform

C.

calculate

D.

normalize

Buy Now
Questions 83

Which of the following eval command function is valid?

Options:

A.

Int ()

B.

Count ( )

C.

Print ()

D.

Tostring ()

Buy Now
Questions 84

Which of the following search control will not re-rerun the search? (Select all that apply.)

Options:

A.

zoom out

B.

selecting a bar on the timeline

C.

deselect

D.

selecting a range of bars on the timelines

Buy Now
Questions 85

Which is not a comparison operator in Splunk

Options:

A.

<=

B.

=

C.

!=

D.

>

E.

?=

Buy Now
Questions 86

Which of the following searches can be used to define an event type?

Options:

A.

index=games sourcetype=score [search index=players | fields player_id]

B.

index=games sourcetype=score I where score>9999

C.

index=games sourcetype=score player=* score>9999

D.

index=games sourcetype=score I stats count by player

Buy Now
Questions 87

When using | timchart by host, which filed is representted in the x-axis?

Options:

A.

date

B.

host

C.

time

D.

-time

Buy Now
Questions 88

Which of the following objects can a calculated field use as a source?

Options:

A.

An alias of a field.

B.

A field added by an automatic lookup.

C.

The tag field.

D.

The eventtype field.

Buy Now
Exam Code: SPLK-1002
Exam Name: Splunk Core Certified Power User Exam
Last Update: Aug 28, 2025
Questions: 294
SPLK-1002 pdf

SPLK-1002 PDF

$25.5  $84.99
SPLK-1002 Engine

SPLK-1002 Testing Engine

$30  $99.99
SPLK-1002 PDF + Engine

SPLK-1002 PDF + Testing Engine

$40.5  $134.99