Splunk Certified Core Power User -
Practice Questions And Answers
/. By default, how is acceleration configured in the Splunk Common Information Model
(CIM) add-on?
A. Turned off.
B. Turned on.
C. Determined automatically based on the sourcetype.
D. Determined automatically based on the data source. - Answer-✅(A) Turned Off
/.Which of the following statements would help a user choose between the transaction
and stats commands?
A. stats can only group events using IP addresses.
B. The transaction command is faster and more efficient.
C. There is a 1000 event limitation with the transaction command.
D. Use stats when the events need to be viewed as a single correlated event. -
Answer-✅(c) there is a 1000 event limitation with the transaction command
/.What does the fillnull command replace null values with, if the value argument is not
specified?
A. 0
B. N/A
C. NaN
D. NULL - Answer-✅(A) 0
/.Which of the following is the correct way to use the datamodel command to search
fields in the Web data model within the Web dataset?
A. | datamodel Web Web search | fields Web*
B. | search datamodel Web Web | fields Web*
C. | datamodel Web Web fields | search Web*
D. datamodel=Web | search Web | fields Web* - Answer-✅(A) | datamodel Web Web
search | fields Web*
/.When using timechart, how many fields can be listed after a by clause?
, A. 0, because timechart doesn't support using a by clause.
B. 1, because _time is already implied as the x-axis.
C. 2, because one field would represent the x-axis and the other would represent the y-
axis.
D. There is no limit specific to timechart. - Answer-✅(B) 1, because _time is already
implied as the x axis
/.Which of the following statements describes calculated fields?
A. Calculated fields are only used on fields added by lookups.
B. Calculated fields are a shortcut for repetitive and complex eval commands.
C. Calculated fields are a shortcut for repetitive and complex calc commands.
D. Calculated fields automatically calculate the simple moving average for indexed
fields. - Answer-✅B. Calculated fields are a shortcut for repetitive and complex eval
commands.
/.In which of the following scenarios is an event type more effective than a saved
search?
A. When a search should always include the same time range.
B. When a search needs to be added to other users' dashboards.
C. When the search string needs to be used in future searches.
D. When formatting needs to be included with the search string. - Answer-✅C. When
the search string needs to be used in future searches.
/.What does the following search do?
index=corndog type=mysterymeat action=eaten | stats count as corndog_count by user
A. Creates a table of the total count of users and split by corndogs.
B. Creates a table of the total count of mysterymeat corndogs split by user.
C. Creates a table with the count of all types of corndogs eaten split by user.
D. Creates a table that groups the total number of users by vegetarian corndogs. -
Answer-✅B. Creates a table of the total count of mysterymeat corndogs split by user.
/.When performing a regular expression (regex) field extraction using the Field Extractor
(FX), what happens when the require option is used?
A. The regex can no longer be edited.
B. The field being extracted will be required for all future events.
C. The events without the required field will not display in searches.
D. Only events with the required string will be included in the extraction. - Answer-✅D.
Only events with the required string will be included in the extraction.
Practice Questions And Answers
/. By default, how is acceleration configured in the Splunk Common Information Model
(CIM) add-on?
A. Turned off.
B. Turned on.
C. Determined automatically based on the sourcetype.
D. Determined automatically based on the data source. - Answer-✅(A) Turned Off
/.Which of the following statements would help a user choose between the transaction
and stats commands?
A. stats can only group events using IP addresses.
B. The transaction command is faster and more efficient.
C. There is a 1000 event limitation with the transaction command.
D. Use stats when the events need to be viewed as a single correlated event. -
Answer-✅(c) there is a 1000 event limitation with the transaction command
/.What does the fillnull command replace null values with, if the value argument is not
specified?
A. 0
B. N/A
C. NaN
D. NULL - Answer-✅(A) 0
/.Which of the following is the correct way to use the datamodel command to search
fields in the Web data model within the Web dataset?
A. | datamodel Web Web search | fields Web*
B. | search datamodel Web Web | fields Web*
C. | datamodel Web Web fields | search Web*
D. datamodel=Web | search Web | fields Web* - Answer-✅(A) | datamodel Web Web
search | fields Web*
/.When using timechart, how many fields can be listed after a by clause?
, A. 0, because timechart doesn't support using a by clause.
B. 1, because _time is already implied as the x-axis.
C. 2, because one field would represent the x-axis and the other would represent the y-
axis.
D. There is no limit specific to timechart. - Answer-✅(B) 1, because _time is already
implied as the x axis
/.Which of the following statements describes calculated fields?
A. Calculated fields are only used on fields added by lookups.
B. Calculated fields are a shortcut for repetitive and complex eval commands.
C. Calculated fields are a shortcut for repetitive and complex calc commands.
D. Calculated fields automatically calculate the simple moving average for indexed
fields. - Answer-✅B. Calculated fields are a shortcut for repetitive and complex eval
commands.
/.In which of the following scenarios is an event type more effective than a saved
search?
A. When a search should always include the same time range.
B. When a search needs to be added to other users' dashboards.
C. When the search string needs to be used in future searches.
D. When formatting needs to be included with the search string. - Answer-✅C. When
the search string needs to be used in future searches.
/.What does the following search do?
index=corndog type=mysterymeat action=eaten | stats count as corndog_count by user
A. Creates a table of the total count of users and split by corndogs.
B. Creates a table of the total count of mysterymeat corndogs split by user.
C. Creates a table with the count of all types of corndogs eaten split by user.
D. Creates a table that groups the total number of users by vegetarian corndogs. -
Answer-✅B. Creates a table of the total count of mysterymeat corndogs split by user.
/.When performing a regular expression (regex) field extraction using the Field Extractor
(FX), what happens when the require option is used?
A. The regex can no longer be edited.
B. The field being extracted will be required for all future events.
C. The events without the required field will not display in searches.
D. Only events with the required string will be included in the extraction. - Answer-✅D.
Only events with the required string will be included in the extraction.
