Free Splunk SPLK-1002 Exam Dumps Questions & Answers

What is required for a macro to accept three arguments?

• A.  The macro's name starts with (3).
• B.  The macro's name ends with (3).
• C.  Nothing, all macros can accept any number of arguments.
• D.  The macro's argument count setting is 3 or more.

During the validation step of the Field Extractor workflow:
Select your answer.

• A.  You can remove values that aren't a match for the field you want to define
• B.  You cannot modify the field extraction
• C.  You can validate where the data originated from

A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

• A.  Convert the numeric to a string with eval first, then sort.
• B.  Use sort first, then convert the numeric to a string with eval.
• C.  You cannot use the sort command and the eval command on the same field.
• D.  It doesn't matter whether eval or sort is used first.

Which of the following searches will return all clientip addresses that start with 108?

• A.  ... | where like (clientip, "108.% )
• B.  ... | where (clientip, "108. %")
• C.  ... | search clientip=108
• D.  ... | where (clientip=108. % )

How are event types different from saved reports?

• A.  Event types do not include a time range.
• B.  Event types include formatting of the search results.
• C.  Event types can be shared with Splunk users and added to dashboards.
• D.  Event types cannot be used to organize data into categories.