SPLK-1002 無料問題集「Splunk Core Certified Power User」

（A）index=games | search IP_Count > 5

（B）index=games I stats count as IP_count by IP B. | where IP_count > 5

（C）index=games I search IP > 5

（D）index=games | where IP > 5

（A）Convert_sales (euro, €, .79)

（B）Convert_sales (euro, €, 79)"

（C）Convert_sales ($euro,$€$,s79$

（D）Convert_sales ($euro, $€$,S,79$)

（A）status field

（B）Data model dataset name.

（C）Multiple indexes

（D）Data model field name.

（A）dev

（B）by standarddev

（C）stdev

（D）count deviation

（A）Amount of data fetched from index matching that time range

（B）Amount of data shown on the timeline as data streams in

（C）Time range for the static results

（A）lookup

（B）eval

（C）transaction

（D）stats

（A）It will automatically contain knowledge objects associated with the base search.

（B）It can contain transforming commands as long as it is a root search dataset.

（C）It can only contain a base search with no transforming commands.

（D）It must contain the transaction command if it is a root transaction dataset.

（A）events

（B）timestamps

（C）statistics

（D）keywords

（A）All events in a transaction must have the same sourcetype.

（B）All events In a transaction must have the same timestamp.

（C）All events in a transaction must be related by one or more fields.

（D）All events in a transaction must have the exact same set of fields.

（A）provide an additional alias for the field that can D.be used in the search criteria

（B）remove duplicate values

（C）Rename a field in the index

（A）state can only group events using IP addresses.

（B）Use state when the events need to be viewed as a single event.

（C）The transaction command is faster and more efficient.

（D）There is a 1000 event limitation with the transaction command.

（A）A macro Is a reusable search string that may have a flexible time range.

（B）A macro is a reusable search string that must contain the full search.

（C）A macro Is a reusable search string that must contain only a portion of the search.

（D）A macro is a reusable search string that must have a fixed time range.

（A）Root events cannot be accelerated.

（B）Private data models cannot be accelerated.

（C）Accelerated data models cannot be edited.

（D）You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.

（A）Datasets are not required.

（B）Creates lookups without using SPL.

（C）Creates reports without using SPL

（D）Data Models are not required.

（A）They can only be created by users with the Admin role.

（B）They can only be created from data models.

（C）They can only be created from summary indexes.

（D）They can only be created from saved reports.