SPLK-1004試験無料問題集（122題）「Splunk Core Certified Advanced Power User 認定」

出題：1

Which of the following can be used to access external lookups?

A. Perl and binary executable

B. Perl and Python

C. Python and Ruby

D. Python and binary executable

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

When a user opens a dataset in Pivot that has not been accelerated, an ad hoc data model acceleration is created. How long does this accelerated data model last?

A. For 24 hours after Pivot was opened

B. For the time specified by a Splunk administrator in limits.conf

C. For 7 days after Pivot was opened

D. For the duration of the user's Pivot session

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

Which of the following is an event handler action?

A. Run an eval statement based on a user clicking a value on a form.

B. Cancel all jobs based on the number of search job results captured.

C. Pass a token from a drilldown to modify index settings.

D. Set a token to select a value from the time range picker.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

What does it mean when a command is run and the is_exact column is 0?

A. The distinct count of fields in the field summary is 1.

B. The distinct count of values for that field is exact.

C. The distinct count of values for that field is exactly 0.

D. The distinct count of values in that field is approximated.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

What is the recommended way to create a field extraction that is both persistent and precise?

A. Use the rex command.

B. Use the Field Extractor and let it automatically generate a regular expression.

C. Use the Field Extractor and manually edit the generated regular expression.

D. Use the erex command.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

How can an underlying search be optimized to improve dashboard performance?

A. Limit the results to a specific time window.

B. Convert the search to an inline search.

C. Use the transaction command instead of stats.

D. Use NOT expressions to filter results.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

Which of the following is true when comparing the rex and erex commands?

A. The rex command is similar to automatic field extraction while erex isn't

B. The erex command requires knowledge of regular expressions while rex doesn't

C. The rex command requires knowledge of regular expressions while erex doesn't

D. The erex command uses data samples to generate regular expressions while rex doesn't

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

How is a multivalue field created from product="a, b, c, d"?

A. ... | makemv delim(product)

B. ... | makemv delim="," product

C. ... | mvexpand product

D. ... | eval mvexpand(makemv(product, ","))

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

What file types does Splunk use to define geospatial lookups?

A. GPX or GML files

B. TXT files

C. CSV files

D. KMZ or KML files

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

A report named "Linux logins" populates a summary index with the search string sourcetype=linux_secure | sitop src_ip user. Which of the following correctly searches against the summary index for this data?

A. index=summary sourcetype="linux_secure" | stats count by src_ip user

B. index=summary search_name="Linux logins" | top src_ip user

C. index=summary search_name="Linux logins" | stats count by src_ip user

D. index=summary sourcetype="linux_secure" | top src_ip user

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

SPLK-1004試験無料問題集「Splunk Core Certified Advanced Power User 認定」