Which search string would only return results for an event type called success ful_purchases?
Correct Answer: C
This is because event types are added to events as a field named eventtype, and you can use this field as a search term to find events that match a specific event type. For example, eventtype=successful_purchases returns all events that have been categorized as successful purchases by the event type definition. The other options are incorrect because they either use a different field name (tag), a different syntax (Event Type:: or event type-), or have a typo (success ful_purchases). You can learn more about how to use event types in searches from the Splunk documentation1.
SPLK-1002 Exam Question 37
Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?
Correct Answer: B
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros The macro definition below shows a macro that tracks user sessions based on two arguments: action and JSESSIONID. sessiontracker(2) The macro definition does the following: It specifies the name of the macro as sessiontracker. This is the name that will be used to execute the macro in a search string. It specifies the number of arguments for the macro as 2. This indicates that the macro takes two arguments when it is executed. It specifies the code for the macro as index=main sourcetype=access_combined_wcookie action=$action$ JSESSIONID=$JSESSIONID$ | stats count by JSESSIONID. This is the search string that will be run when the macro is executed. The search string can contain any part of a search, such as search terms, commands, arguments, etc. The search string can also include variables for the arguments using dollar signs around them. In this case, action and JSESSIONID are variables for the arguments that will be replaced by their values when the macro is executed. Therefore, to correctly configure the macro, you should enter sessiontracker as the name and action, JSESSIONID as the arguments. Alternatively, you can use sessiontracker(2) as the name and leave the arguments blank.
SPLK-1002 Exam Question 38
We can use the rename command to _____ (Select all that apply.)
Correct Answer: A
SPLK-1002 Exam Question 39
Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)
Correct Answer: A,B,C,D
Data model fields are fields that describe the attributes of a dataset in a data model2. Data model fields can be added using various methods such as Auto-Extracted, Evaluated or Lookup2. Auto-Extracted fields are fields that are automatically extracted from your raw data using various techniques such as regular expressions, delimiters or key-value pairs2. Auto-Extracted fields can be hidden in Pivot, which means that you can choose whether to display them or not in the Pivot interface2. Therefore, option A is correct. Auto-Extracted fields can have their data type changed, which means that you can specify whether they are strings, numbers, booleans or timestamps2. Therefore, option B is correct. Auto-Extracted fields can be given a friendly name for use in Pivot, which means that you can assign an alternative name to them that is more descriptive or user-friendly than the original field name2. Therefore, option C is correct. Auto-Extracted fields can be added if they already exist in the dataset with constraints, which means that you can include them in your data model even if they are already extracted from your raw data by applying filters or constraints to limit the scope of your dataset2. Therefore, option D is correct.
SPLK-1002 Exam Question 40
These users can create global knowledge objects. (Select all that apply.)