What commands can be used to group events from one or more data sources?
Answer : B
Consider the the following search run over a time range of last 7 days:
index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane
Which option is used to change the default time span so that results are grouped into 12 hour intervals?
Which of the following expressions could be used to create a calculated field called gigabytes?
Answer : B
When defining a macro, what are the required elements?
Answer : C
Which of the following is true about the Splunk Common Information Model (CIM)?
Answer : D
The Splunk Common Information Model (CIM) is an app that contains a set of predefined data models that apply a common structure and naming convention to data from any source. The CIM enables you to use data from different sources in a consistent and coherent way. The CIM contains 28 pre-configured datasets that cover various domains such as authentication, network traffic, web, email, etc. The data models included in the CIM are configured with data model acceleration turned on by default, which means that they are optimized for faster searches and analysis. Data model acceleration creates and maintains summary data for the data models, which reduces the amount of raw data that needs to be scanned when you run a search using a data model.
: Splunk Core Certified Power User Track, page 10. : Splunk Documentation, About the Splunk Common Information Model.
Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?
Answer : A
Which tool uses data models to generate reports and dashboard panels without using SPL?