SPLK-1002 Practice Test

SPLK-1002 Practice Test practice questions, page 4 of 10, with answer review and explanations.

Question 16

A data model consists of which three types of datasets?

  1. Constraint, field, value.
  2. Events, searches, transactions.
  3. Field extraction, regex, delimited.
  4. Transaction, session ID, metadata.

Question 17

Where are the results of eval commands stored?

  1. In a field.
  2. In an index.
  3. In a KV Store.
  4. In a database.

Question 18

Which of the following statements describe calculated fields? (Choose all that apply.)

  1. Calculated fields can be used in the search bar.
  2. Calculated fields can be based on an extracted field.
  3. Calculated fields can only be applied to host and sourcetype.
  4. Calculated fields are shortcuts for performing calculations using the eval command.

Question 19

Calculated fields can be based on which of the following?

  1. Tags
  2. Extracted fields
  3. Output fields for a lookup
  4. Fields generated from a search string

Question 20

When should transaction be used?

  1. Only in a large distributed Splunk environment.
  2. When calculating results from one or more fields.
  3. When event grouping is based on start/end values.
  4. When grouping events results in over 1000 events in each group.