SPLK-1002 Practice Test

SPLK-1002 Practice Test practice questions, page 3 of 10, with answer review and explanations.

Question 11

By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

  1. Turned off.
  2. Turned on.
  3. Determined automatically based on the sourcetype.
  4. Determined automatically based on the data source.

Question 12

Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)

  1. CIM is a methodology for normalizing data.
  2. CIM can correlate data from different sources.
  3. The Knowledge Manager uses the CIM to create knowledge objects.
  4. CIM is an app that can coexist with other apps on a single Splunk deployment.

Question 13

Which of the following knowledge objects represents the output of an eval expression?

  1. Eval fields
  2. Calculated fields
  3. Field extractions
  4. Calculated lookups

Question 14

What do events in a transaction have in common?

  1. All events in a transaction must have the same timestamp.
  2. All events in a transaction must have the same sourcetype.
  3. All events in a transaction must have the exact same set of fields.
  4. All events in a transaction must be related by one or more fields.

Question 15

Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)

  1. Tabs
  2. Pipes
  3. Spaces
  4. Commas