無料Splunk SPLK-1002試験問題と解答トレーニングを提供しています
トップクラスSplunk SPLK-1002オンライン問題集
質問 # 112
Which of the following statements about calculated fields in Splunk is true?
- A. Calculated fields can only be used in saved reports.
- B. Calculated fields can only be used in dashboards.
- C. Calculated fields can be chained together to create more complex fields.
- D. Calculated fields cannot be chained together to create more complex fields
正解：C
解説：
The correct answer is B. Calculated fields can be chained together to create more complex fields.
Calculated fields are fields that are added to events at search time by using eval expressions. They can be used
to perform calculations with the values of two or more fields already present in those events. Calculated fields
can be defined with Splunk Web or in the props.conf file.They can be used insearches, reports, dashboards,
and data models like any other extracted field1.
Calculated fields can also be chained together to create more complex fields. This means that you can use a
calculated field as an input for another calculated field. For example, if you have a calculated field
namedtotalthat sums up the values of two fields namedpriceandtax, you can use thetotalfield to create another
calculated field nameddiscountthat applies a percentage discount to thetotalfield. To do this, you need to
define thediscountfield with an eval expression that references thetotalfield, such as:
discount = total * 0.9
This will create a new field nameddiscountthat is equal to 90% of thetotalfield value for each event2.
References:
About calculated fields
Chaining calculated fields
質問 # 113
Which Knowledge Object does the Splunk Common Information Model (CIM) use to normalize data, in addition to field aliases, event types, and tags?
- A. Macros
- B. Field extractions
- C. Workflow actions
- D. Lookups
正解：D
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
質問 # 114
Which of the following searches would create a graph similar to the one below?
- A. None of these searches would generate a similart graph.
- B. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states
- C. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time
- D. index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status
正解：D
解説：
The following search would create a graph similar to the one below:
index_internal sourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status The search does the following:
* It uses index_internal to specify the internal index that contains Splunk logs and metrics.
* It uses sourcetype=Savesplunker to filter events by the sourcetype that indicates the Splunk Enterprise Security app.
* It uses fields sourcetype, status to keep only the sourcetype and status fields in the events.
* It uses transaction status maxspan=1d to group events into transactions based on the status field with a maximum time span of one day between the first and last events in a transaction.
* It uses timechart count by status to create a time-based chart that shows the count of transactions for each status value over time.
The graph shows the following:
* It is a line graph with two lines, one yellow and one blue.
* The x-axis is labeled with dates from Wed, Apr 4, 2018 to Tue, Apr 10, 2018.
* The y-axis is labeled with numbers from 0 to 15.
* The yellow line represents "shipped" and the blue line represents "success".
* The yellow line has a steady increase from 0 to 15, while the blue line has a sharp increase from 0 to 5, then a decrease to 0, and then a sharp increase to 10.
* The graph is titled "Type".
Therefore, option C is the correct answer.
質問 # 115
How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)
- A. | chart count over CurrentStanding by Action useother=f
- B. | chart count over CurrentStanding by Action usenull-f useother-t
- C. | chart count over CurrentStanding by Action limit-10
- D. | chart count over CurrentStanding by Action limit=10 useother=f
正解：A、D
解説：
In Splunk, when using the chart command, the useother parameter can be set to false (f) to remove the
'OTHER' category, which is a bucket that Splunk uses to aggregate low-cardinality groups into a single group to simplify visualization. Here's how the options break down:
A: | chart count over CurrentStanding by Action useother=fThis command correctly sets the useother parameter to false, which would prevent the 'OTHER' category from being displayed in the resulting visualization.
B: | chart count over CurrentStanding by Action usenull=f useother=tThis command has useother set to true (t), which means the 'OTHER' category would still be included, so this is not a correct option.
C: | chart count over CurrentStanding by Action limit=10 useother=fSimilar to option A, this command also sets useother to false, additionally imposing a limit to the top 10 results, which is a way to control the granularity of the chart but also to remove the 'OTHER' category.
D: | chart count over CurrentStanding by Action limit-10This command has a syntax error (limit-10 should be limit=10) and does not include the useother=f clause. Therefore, it would not remove the 'OTHER' category, making it incorrect.
The correct answers to rewrite the syntax to remove the 'OTHER' category are options A and C, which explicitly set useother=f.
質問 # 116
When should transactionbe used?
- A. When calculating results from one or more fields.
- B. When grouping events results in over 1000 events in each group.
- C. Only in a large distributed Splunk environment.
- D. When event grouping is based on start/end values.
正解：A
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Abouttransactions
質問 # 117
Which of the following can a field alias be applied to?
- A. Sourcetypes
- B. Indexes
- C. Tags
- D. Event types
正解：A
解説：
Field aliases are applied based on host, source, or sourcetype.
Extract: "Create field aliases by specifying the host, source, or sourcetype that the alias applies to." Thus, the correct answer is Sourcetypes.
質問 # 118
Why would the following search produce multiple transactions instead of one?
The maxspan option is not included.
The transaction command has a limit of 1000 events per transaction.
The transaction and commands cannot be used together.
The stats list () function is used.
- A. The maxspan option is not included1.
正解：A
解説：
In Splunk, the transaction command is used to group events that share common characteristics into a single transaction1. By default, the transaction command groups all matching events into a single transaction1.
However, you can use the maxspan option to limit the time span of the transactions1. If the time span between the first and last event in a transaction exceeds the maxspan value, the transaction command will start a new transaction1.
Therefore, if the maxspan option is not included in the search, the transaction command might produce multiple transactions instead of one if the time span between the first and last event in a transaction exceeds the default maxspan value1.
Here is an example of how you can use the maxspan option in a search:
index=main sourcetype=access_combined | transaction someuniqefield maxspan=1h In this search, the transaction command groups events that share the same someuniqefield value into a single transaction, but only if the time span between the first and last event in the transaction does not exceed 1 hour1. If the time span exceeds 1 hour, the transaction command will start a new transaction1.
Explanation:
The correct answer is
質問 # 119
Why would the following search produce multiple transactions instead of one?
- A. The stats list () function is used.
- B. The transaction command has a limit of 1000 events per transaction.
- C. The maxspan option is not included.
- D. The transaction and commands cannot be used together.
正解：B
解説：
Explanation
The correct answer is B. The transaction command has a limit of 1000 events per transaction.
The transaction command is used to group events that share some common values into a single record, called a transaction. A transaction can span multiple events and multiple sources, and can be useful for correlating events that are related but not contiguous1.
However, the transaction command has some limitations, one of which is that it can only group up to 1000 events per transaction. This means that if there are more than 1000 events that match the criteria for a transaction, they will be split into multiple transactions. This can result in incomplete or inaccurate transactions2.
To avoid this limitation, you can use the stats command instead of the transaction command. The stats command can also group events by common values, but it does not have a limit on the number of events per group. The stats command also performs faster and consumes less memory than the transaction command1.
In your search, you are using the stats list() function to group events by src_ip and dest_ip. This function returns a multivalue field that contains all the values of a given field for each group. However, this function does not create a single correlated event like the transaction command does. Instead, it creates a table of results with one row per group and one column per field3.
Therefore, your search will produce multiple transactions instead of one because you are using the transaction command with a limit of 1000 events per transaction, and you are using the stats list() function that does not create a single correlated event.
References:
stats command overview
transaction command overview
Splunk Transaction Command: What It Is and How to Use It
Splunk Core Certified Power User SPLK-1002 Practice Exam Part 1
質問 # 120
When you run a search, fast mode extracts all fields very quickly
- A. True
- B. False
正解：A
質問 # 121
If a search returns ____________ it can be viewed as a chart.
- A. timestamps
- B. statistics
- C. keywords
- D. events
正解：B
解説：
If a search returns statistics, it can be viewed as a chart2. Statistics are tabular data that show the relationship
between two or more fields2. You can create statistics by using commands such as stats, chart or
timechart2. You can view statistics as a chart by selecting the Visualization tab in the Search app and choosing
a chart type such as column, line or pie2. Therefore, option B is correct, while options A, C and D are
incorrect because they are not types of data that can be viewed as a chart.
質問 # 122
Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)
- A. Email
- B. Alerts
- C. Database
- D. User permissions
正解：A、B、C
解説：
Reference:https://docs.splunk.com/Documentation/CIM/4.15.0/User/Overview
質問 # 123
A space is an implied _____ in a search string.
- A. ()
- B. AND
- C. OR
- D. NOT
正解：B
質問 # 124
Which search mode automatically decides how to return fields based on your search?
- A. Smart mode
- B. Fast mode
- C. Verbose mode
正解：A
質問 # 125
36. Lookups can be private for a user.
- A. True
- B. False
正解：A
質問 # 126
What does the following search do?
- A. Creates a table that groups the total number of users by vegetarian corndogs.
- B. Creates a table of the total count of mysterymeat corndogs split by user.
- C. Creates a table of the total count of users and split by corndogs.
- D. Creates a table with the count of all types of corndogs eaten split by user.
正解：B
解説：
The search string below creates a table of the total count of mysterymeat corndogs split by user.
| stats count by user | where corndog=mysterymeat
The search string does the following:
* It uses the stats command to calculate the count of events for each value of the user field. The stats command creates a table with two columns: user and count.
* It uses the where command to filter the results by the value of the corndog field. The where command only keeps the rows where corndog equals mysterymeat.
Therefore, the search string creates a table of the total count of mysterymeat corndogs split by user.
質問 # 127
When should the delimiter method be used in the Field Extractor?
- A. When the events are separated by a consistent character or set of characters.
- B. When the events need to be calculated using special characters.
- C. When the events do not have the correct permissions set.
- D. When the events need a regular expression to define the matching pattern.
正解：A
解説：
The delimiter method in the Field Extractor should be used when fields in events are separated consistently by a specific character (such as a comma, tab, or pipe). This method simplifies extraction without requiring complex regular expressions.
Reference:
Splunk Power User Study Guide, Field Extraction Section
Splunk Docs: Using the Field Extractor
"Use the delimiter extraction method when your data fields are consistently separated by a specific delimiter character."
質問 # 128
......
最新（2025)Splunk SPLK-1002試験問題集：https://www.goshiken.com/Splunk/SPLK-1002-mondaishu.html
SPLK-1002練習問題集で検証済みのGoShiken更新された308問題あります：https://drive.google.com/open?id=1Yqrf1CxMddYHze-LlRsG11Iw21rlM6U3