Splunk Core Power User (SPLK-1002) Certification Sample Questions

02. A source's fields are mapped onto a CIM data model's expected names, so that searches already written against the model return that source's events. What happens to the events already indexed from it?
a) They stay as they are, and only events indexed afterwards are covered
b) They are rewritten so the model's field names are stored on them
c) They stay as they are; the mapping applies while a search runs
d) They are re-indexed the next time one of the CIM Add-On's models is opened

03. Which eval function returns one value or another depending on whether a test holds?
a) if()
b) round()
c) substr()
d) len()

04. A search must return the events where the value of the 10yearAnniversary field equals the value of the Renewal-MonthYear field. Which clause does that?
a) | where 10yearAnniversary=Renewal-MonthYear
b) | where '10yearAnniversary'='Renewal-MonthYear'
c) | where "10yearAnniversary" = "Renewal-MonthYear"
d) | search 10yearAnniversary=Renewal-MonthYear

05. Several event types describe related failure conditions, and each is already saved. An analyst wants one name that reaches all of them at once in a search. What provides it?
a) A calculated field derived from the eventtype value
b) A field alias giving eventtype a second name
c) A further event type whose condition matches the same events
d) A tag applied to each of those event type values

06. A POST workflow action is being created to hand a selected field value to an external ticketing endpoint. What does its definition need that a GET action's does not?
a) A URI naming the external system the action reaches
b) A label for the entry that appears in the event action menu
c) The POST arguments, as the name and value pairs to send
d) The event types the action should be offered on

07. What is the recommended approach when using the Splunk Common Information Model (CIM) Add-On to normalize a new data source?
a) Apply the CIM tags to the events and let the Add-On rename the source's fields automatically
b) Re-index the source so that the CIM field names are written into the stored events
c) Edit the data models that ship with the Add-On so they use the field names the source already writes
d) Consult the reference for the relevant CIM data model and map the source's fields onto the names it expects

08. A user runs the Field Extractor on a comma-separated log and chooses the delimiter method. What does the user do next to finish the extraction?
a) Write a regular expression with a capture group for each field.
b) Name each of the fields that the delimiter has split the event into.
c) Choose the index that the new fields will be stored in.
d) Choose the existing field the new values should be aliased onto.

09. Events returned by index=web sourcetype=access_combined share a JSESSIONID value, and each session's events need to be combined into a single grouped event. Which search does that?
a) index=web sourcetype=access_combined JSESSIONID=SD404K289O2F151
b) index=web sourcetype=access_combined | stats count by JSESSIONID
c) index=web sourcetype=access_combined | table JSESSIONID
d) index=web sourcetype=access_combined | transaction JSESSIONID

10. A macro is defined as weekly_sales(2) and contains the search string index=games | eval ProductSales = $Price$ * $AmountSold$. Which reference to that macro returns results?
a) `weekly_sales(3.995, 108)`
b) weekly_sales(3.995, 108)
c) `weekly_sales(3.995)`
d) `weekly_sales($3.995$, $108$)`