Free Splunk SPLK-1002 Exam Dumps and SPLK-1002 Exam Questions

Question No: 1

MultipleChoice

Why would the following search produce multiple transactions instead of one?

The maxspan option is not included.

The transaction command has a limit of 1000 events per transaction.

The transaction and commands cannot be used together.

The stats list () function is used.

Options

AThe maxspan option is not included1.
In Splunk, the transaction command is used to group events that share common characteristics into a single transaction1. By default, the transaction command groups all matching events into a single transaction1.
However, you can use the maxspan option to limit the time span of the transactions1. If the time span between the first and last event in a transaction exceeds the maxspan value, the transaction command will start a new transaction1.
Therefore, if the maxspan option is not included in the search, the transaction command might produce multiple transactions instead of one if the time span between the first and last event in a transaction exceeds the default maxspan value1.
Here is an example of how you can use the maxspan option in a search:
index=main sourcetype=access_combined | transaction someuniqefield maxspan=1h
In this search, the transaction command groups events that share the same someuniqefield value into a single transaction, but only if the time span between the first and last event in the transaction does not exceed 1 hour1. If the time span exceeds 1 hour, the transaction command will start a new transaction1.

Question No: 2

MultipleChoice

The Splunk CIM Add-on includes data models in a __________ format.

Select your answer.

Options

AMySQL

BXML

CJSON

Question No: 3

MultipleChoice

When using a split series on a chart, the series MUST be displayed using the STACKED option.

Options

ATrue

BFalse

Question No: 4

MultipleChoice

This role is required to install the CIM Add-on.

Select your answer.

Options

AADMIN

BPOWER

CUSER

Question No: 5

MultipleChoice

Which of the following are valid options with the chart command ?(select all that apply)

Options

Ausenull=f

Buseother=f

Csplit=t

Dtranscation=t

Question No: 6

MultipleChoice

This tab shows you the event patterns in the results of a specific search.

Options

Astatistics

Bvisualization

Cpatterns

Question No: 7

MultipleChoice

A real-time alert is ______________.

Options

AA scheduled alert

Bconstantly running in the background

Question No: 8

MultipleChoice

Alert throttling is used to _______.

Options

Averify each alert

Bstagger search request in a time sequenced order

Cstop spamming yourself with alerts

Dcheck severity

Question No: 9

MultipleChoice

Why would the following search produce multiple transactions instead of one?

Options

AThe maxspan option is not included.

BThe transaction command has a limit of 1000 events per transaction.

CThe transaction and commands cannot be used together.

DThe stats list () function is used.

Question No: 10

MultipleChoice

Which search would limit an 'alert' tag to the 'host' field?

Options

Atag=alert

Bhost::tag::alert

Ctag==alert

Dtag::host=alert