Exam (elaborations)
Splunk Core Certified Power User Exam with Questions Solved 100% Correct
- Course
- Institution
Splunk Core Certified Power User Exam with Questions Solved 100% Correct
[Show more]
Seller
Follow
Content preview
Splunk Core Certified Power User Exam withQuestions Solved 100% Correct
What is the Splunk Common Information Model (CIM) - Answer A methodology for
normalizing data, easily correlate data from different sources and source type.
Which meta fields are already stored in the index prior to search time? - Answer host,
source and sourcetype
Which internal fields are stored in the index prior to search time? - Answer _time and
_raw
At this time, field discovery discovers fields directly related to the search's results -
Answer search time
(True/False) After extracting fields using the field extractor (FX), it is possible to share
the extracted fields. - Answer True. Extracted fields exists as knowledge objects.
,What are the two methods for doing field extractions? - Answer Regex and delimiter
These knowledge objects provide a way of normalizing data over any default field -
Answer field aliases
(True/false) Field aliases are applied after field extraction, before lookups - Answer True
(True/false) It is not possible to apply field aliases to lookups - Answer False
(True/false) Multiple aliases can be applied to one field - Answer True
(True/false) After a field alias have been made, the field alias can be used as an ordinary
field in SPL - Answer True
What is a calculated field? - Answer Shortcut for performing repetitive, long, or complex
transformations using the eval command
What is true about a calculated field? - Answer Must be based on an extracted field
Where can both calculated field and field aliases be set up (using the GUI)? - Answer
Settings->Fields
These knowledge objects are like nicknames that are created for related field/value
pairs - Answer Tags
(True/False) Tags are case sensitive - Answer True
, (True/False) You can only create one tag for any field/value combination - Answer False
(True/False)Knowledge objects like tags, field aliases and calculated fields are
searchable - Answer True
How does a tag appear after being selected? - Answer In the results as tags, in
parantheses next to the associated field/value pairs
The syntax for searching for a tag associated with a value is? - Answer tag=<tag name>
The syntax for searching for a tag associated with a value on a specific field is? - Answer
tag::<field> = <tagname>
Where can tag-settings (including permissions) be edited? - Answer Settings->Tags-> List
by field value pair
This knowledge object can be used to group similar types of events - Answer Event types
How do you create an event type? - Answer Create and execute a search, press "save
as"-> Event types
(True/False) Event type names can contain spaces - Answer False
Which criterias must be reviewed and refined when using the Event Type Builder? -
Answer Search string, Field values, tags
What is the syntax for using eventtypes in a search? - Answer
eventtype=<eventtype_name>
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller KenAli. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $12.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
81113 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now