Pass the Splunk Core Certified Power User SPLK-1002 Questions and answers with ValidTests

Event types in Splunk are saved as static search strings. The example index=server_485 sourcetype=BETA_726 code=917 is a simple search that can be saved as an event type, as it does not contain dynamic processing commands like stats or inputlookup, which are not valid for event types.

 The following search would create a graph similar to the one below:

index_internal sourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status

The search does the following:

It uses index_internal to specify the internal index that contains Splunk logs and metrics.

It uses sourcetype=Savesplunker to filter events by the sourcetype that indicates the Splunk Enterprise Security app.

It uses fields sourcetype, status to keep only the sourcetype and status fields in the events.

It uses transaction status maxspan=1d to group events into transactions based on the status field with a maximum time span of one day between the first and last events in a transaction.

It uses timechart count by status to create a time-based chart that shows the count of transactions for each status value over time.

The graph shows the following:

It is a line graph with two lines, one yellow and one blue.

The x-axis is labeled with dates from Wed, Apr 4, 2018 to Tue, Apr 10, 2018.

The y-axis is labeled with numbers from 0 to 15.

The yellow line represents “shipped” and the blue line represents “success”.

The yellow line has a steady increase from 0 to 15, while the blue line has a sharp increase from 0 to 5, then a decrease to 0, and then a sharp increase to 10.

The graph is titled “Type”.

Therefore, option C is the correct answer.

In Splunk, macros that accept arguments are defined with placeholders for those arguments in the format example(var1, var2). In the search example(100,200), "100" and "200" are the values passed for var1 and var2 respectively.

A report that is scheduled to run every 15 minutes but takes 17 minutes to complete is in danger of being skipped or deferred2. This means that Splunk may skip some scheduled runs of the report if they overlap with previous runs that are still in progress or defer them until the previous runs are finished2. This can affect the accuracy and timeliness of the report results and notifications2. Therefore, option A is correct, while options B, C and D are incorrect because they are not consequences of a report taking longer than its schedule interval.

When you define a calculated field, you can specify the name of the field that the eval expression will create or modify. If the name of the calculated field matches the name of an existing extracted field, the calculated field will override the extracted field and replace its value with the result of the eval expression. This means that the original value of the extracted field will not be available for searching or analysis. To avoid this, you should use a unique name for your calculated field or use a different name for your extracted field2

1: Splunk Core Certified Power User Track, page 9. 2: Splunk Documentation, Configure calculated fields with props.conf.