Free Splunk SPLK-1002 Exam Dumps Questions & Answers

Which of the following objects can a calculated field use as a source?

• A.The tag field.
• B.An alias of a field.
• C.The eventtype field.
• D.A field added by an automatic lookup.

A calculated field may be based on which of the following?

• A.Extracted fields
• B.Regular expressions
• C.Lookup tables
• D.Fields generated within a search string

When using the transaction command, what is the assigned timestamp for each of the resulting transactions?

• A.The timestamp of the most recent event.
• B.The timestamp of the event search time execution.
• C.The difference between the earliest and latest event.
• D.The timestamp of the earliest event.

During the validation step of the Field Extractor workflow:
Select your answer.

• A.You cannot modify the field extraction
• B.You can remove values that aren't a match for the field you want to define
• C.You can validate where the data originated from

Which command can include both an over and a by clause to divide results into sub-groupings?

• A.chart
• B.transaction
• C.stats
• D.xyseries