Splunk Core Certified Power User SPLK-1002 Exam Questions

Answer : B

The correct answer is B. Use the field values in an HTTP error event to create a new ticket in an external system.

A workflow action is a knowledge object that enables a variety of interactions between fields in events and other web resources. Workflow actions can create HTML links, generate HTTP POST requests, or launch secondary searches based on field values1.

There are three types of workflow actions that can be set up using Splunk Web: GET, POST, and Search2.

GET workflow actions create typical HTML links to do things like perform Google searches on specific values or run domain name queries against external WHOIS databases2.

POST workflow actions generate an HTTP POST request to a specified URI. This action type enables you to do things like creating entries in external issue management systems using a set of relevant field values2.

Search workflow actions launch secondary searches that use specific field values from an event, such as a search that looks for the occurrence of specific combinations of ipaddress and http_status field values in your index over a specific time range2.

Therefore, the example that would use a POST workflow action is B. Use the field values in an HTTP error event to create a new ticket in an external system. This example requires sending an HTTP POST request to the URI of the external system with the field values from the event as arguments.

The other examples would use different types of workflow actions. These examples are:

A) Perform an external IP lookup based on a domain value found in events: This example would use a GET workflow action to create a link to an external IP lookup service with the domain value as a parameter.

C) Launch secondary Splunk searches that use one or more field values from selected events: This example would use a Search workflow action to run another Splunk search with the field values from the event as search terms.

D) Open a web browser to look up an HTTP status code: This example would also use a GET workflow action to create a link to a web page that explains the meaning of the HTTP status code.

Splexicon:Workflowaction

About workflow actions in Splunk Web

Answer : B, C, D

The commandsourcetype=access_combined | transaction JSESSIONIDdoes three things:

It filters the events by the sourcetypeaccess_combined, which is a predefined sourcetype for Apache web server logs.

It groups the events by the fieldJSESSIONID, which is a unique identifier for each user session.

It creates a single event from each group of events that share the sameJSESSIONIDvalue. This single event will have some additional fields created by the transaction command, such asduration,eventcount, andstartime.

Therefore, the statements B, C, and D are true.

Answer : C

When defining a search macro, the required elements are the name and the definition of the macro. The name is a unique identifier for the macro that can be used to invoke it in other searches. The definition is the search string that the macro expands to when referenced.The arguments, validation expression, and validation error message are optional elements that can be used to customize the macro behavior and input validation2

1: Splunk Core Certified Power User Track, page 9.2: Splunk Documentation, Define search macros in Settings.

Answer : C

Answer : A

The Common Information Model (CIM) add-on in Splunk applies preconfigured data models to data at search time. This means that when a search is executed, the CIM add-on uses its predefined data models to normalize and map the relevant data to a common format. This approach ensures that data is interpreted and analyzed consistently across various datasets without modifying the data at index time.

Splunk Docs: About the Common Information Model

Splunk Answers: CIM Add-on Data Models

Answer : B

If a search returns statistics, it can be viewed as a chart2.Statistics are tabular data that show the relationship between two or more fields2.You can create statistics by using commands such as stats, chart or timechart2.You can view statistics as a chart by selecting the Visualization tab in the Search app and choosing a chart type such as column, line or pie2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of data that can be viewed as a chart.

Answer : B