Weekend Sale - Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70dumps

SPLK-1004 Questions and Answers

Question # 6

What is the correct hierarchy of XML elements in a dashboard panel?

A.

B.

C.

D.

Full Access
Question # 7

Which of the following is true about Log Event alerts?

A.

They must be used with other alert actions.

B.

They cannot use tokens to reference event fields.

C.

They require at least Power User role.

D.

They create new searchable events.

Full Access
Question # 8

Which of the following groups of commands can use multivalue functions?

A.

eval,fieldformat, andwhere

B.

eval,fields, andwhere

C.

fieldformat,search, andwhere

D.

eval,mvexpand, andmakemv

Full Access
Question # 9

What is a performance improvement technique unique to dashboards?

A.

Using stats instead of transaction

B.

Using global searches

C.

Using report acceleration

D.

Using data model acceleration

Full Access
Question # 10

Which stats function is used to return a sorted list of unique field values?

A.

values

B.

sum

C.

count

D.

list

Full Access
Question # 11

What capability does a power user need to create a Log Event alert action?

A.

edit_search_server

B.

edit_udp

C.

edit_tcp

D.

edit_alerts

Full Access
Question # 12

Which predefined drilldown token passes a clicked value from a table row?

A.

$table.$

B.

$rowclick.$

C.

$row.$

D.

$tableclick.$

Full Access
Question # 13

Which of the following correctly uses mvfilter?

A.

mvfilter(isnotnull(X))

B.

mvfilter(x, isnotnull)

C.

where mvfilter(isnotnull(X))

D.

eval new_field=mvfilter(*)

Full Access
Question # 14

How can the erex and rex commands be used in conjunction to extract fields?

A.

The regex generated by the erex command can be edited and used with the rex command in a subsequent search.

B.

The regex generated by the rex command can be edited and used with the erex command in a subsequent search.

C.

The regex generated by the erex command can be edited and used with the erex command in a subsequent search.

D.

The erex and rex commands cannot be used in conjunction under any circumstances.

Full Access
Question # 15

Which of the following is true about the preview feature and macros?

A.

The preview feature expands only the selected macro within the search.

B.

The preview feature can be launched using Tab-Shift-E on Mac or Windows.

C.

The preview feature can be launched by right-clicking on the macro name in the search string.

D.

The preview feature expands all macros within the search, including nested macros.

Full Access
Question # 16

When working with an accelerated data model acc_datmodel and an unaccelerated data model unacc_datmodel, what tstats query could be used to search one of these data models?

A.

| tstats count from datamodel=acc_datmodel summariesonly=false

B.

| tstats count where datamodel=acc_datmodel summariesonly=false

C.

| tstats count where index=datamodel by index, datamodel

D.

| tstats count from datamodel=unacc_datmodel summariesonly=true

Full Access
Question # 17

When using thebincommand, what attributes are used to define the size and number of sets created?

A.

binsandstartandend

B.

binsandminspan

C.

binsandspan

D.

binsandlimit

Full Access
Question # 18

Which Job Inspector component displays the time taken to process field extractions?

A.

command.search.filter

B.

command.search.fields

C.

command.search.kv

D.

command.search.regex

Full Access
Question # 19

When enabled, what drilldown action is performed when a visualization is clicked in a dashboard?

A.

A visualization is opened in a new window.

B.

Search results are refreshed for the selected visualization.

C.

Search results are refreshed for all panels in a dashboard.

D.

A search is opened in a new window.

Full Access
Question # 20

Why is the transaction command slow in large Splunk deployments?

A.

It forces the search to run in fast mode.

B.

The transaction runs on each indexer in parallel.

C.

It forces all event data to be returned to the search head.

D.

The transaction runs a hidden eval to format fields.

Full Access
Question # 21

How can an underlying search be optimized to improve dashboard performance?

A.

Limit the results to a specific time window.

B.

Convert the search to an inline search.

C.

Use NOT expressions to filter results.

D.

Use the transaction command instead of stats.

Full Access
Question # 22

What type of drilldown passes a value from a user click into another dashboard or external page?

A.

Visualization

B.

Event

C.

Dynamic

D.

Contextual

Full Access
Question # 23

What is an example of the simple XML syntax for a base search and its post-process search?

A.

,

B.

,

C.

,

D.

,

Full Access
Question # 24

What is the function of the |s token filter?

A.

|s is not a valid token filter.

B.

To wrap a value in double quotes.

C.

To force no encoding to occur.

D.

To encode URL values.

Full Access
Question # 25

Which field is required for an event annotation?

A.

annotation_category

B.

_time

C.

eventtype

D.

annotation_label

Full Access
Question # 26

Which command processes a template for a set of related fields?

A.

bin

B.

xyseries

C.

foreach

D.

untable

Full Access
Question # 27

Consider the following search:

(index=_internal log group=tcpin connections) earliest

| stats count as _count by sourceHost guid fwdType version

| eventstats dc(sourceHost) as dc_sourceHost by guid

| where dc_sourceHost > 1

| fields - dc_sourceHost

| xyseries guid fwdType sourceHost

| search guid="00507345-CE09-4A5E-428-D3E8718CB065"

| appendpipe [ stats count | eval "Duplicate GUID" = if(count==0, "Yes", "No") ]

Which of the following are transforming commands?

A.

where and search

B.

fields and appendpipe

C.

stats and xyseries

D.

eval and eventstats

Full Access
Question # 28

When would a distributable streaming command be executed on an indexer?

A.

If any of the preceding search commands are executed on the search head.

B.

If all preceding search commands are executed on the indexer, and a streamstats command is used.

C.

If all preceding search commands are executed on the indexer.

D.

If some of the preceding search commands are executed on the indexer, and a timerchart command is used.

Full Access
Question # 29

What is the recommended way to create a field extraction that is both persistent and precise?

A.

Use the rex command.

B.

Use the Field Extractor and manually edit the generated regular expression.

C.

Use the Field Extractor and let it automatically generate a regular expression.

D.

Use the erex command.

Full Access
Question # 30

Which of the following is accurate about cascading inputs?

A.

They can be reset by an event handler.

B.

The final input has no impact on previous inputs.

C.

Only the final input of the sequence can supply a token to searches.

D.

Inputs added to panels cannot participate.

Full Access
Question # 31

When running a search, which Splunk component retrieves the individual results?

A.

Indexer

B.

Search head

C.

Universal forwarder

D.

Master node

Full Access
Question # 32

Which of the following is true when comparing the rex and erex commands?

A.

The rex command is similar to automatic field extraction while erex isn't

B.

The erex command uses data samples to generate regular expressions while rex doesn't

C.

The rex command requires knowledge of regular expressions while erex doesn't

D.

The erex command requires knowledge of regular expressions while rex doesn't

Full Access
Question # 33

Which of the following is true about nested macros?

A.

The inner macro should be created first.

B.

The outer macro should be created first.

C.

The outer macro name must be surrounded by backticks.

D.

The inner macro passes arguments to the outer macro.

Full Access
Question # 34

When possible, what is the best choice for summarizing data to improve search performance?

A.

Use the fieldsummary command.

B.

Data model acceleration

C.

Report acceleration

D.

Summary indexing

Full Access
Question # 35

When should the fill_summary_index.py script be used?

A.

To create a summary index.

B.

To backfill gaps in a summary index.

C.

To reset a summary index that includes overlapping data.

D.

To populate a summary index from a saved report.

Full Access
Question # 36

When a user opens a dataset in Pivot that has not been accelerated, an ad hoc data model acceleration is created. How long does this accelerated data model last?

A.

For the time specified by a Splunk administrator in limits.conf

B.

For the duration of the user's Pivot session

C.

For 24 hours after Pivot was opened

D.

For 7 days after Pivot was opened

Full Access