Free Splunk SPLK-1002 Exam Questions

Become Splunk Certified with updated SPLK-1002 exam questions and correct answers

Page: 1 / 60

Total 300 Questions | Updated On: Mar 25, 2025

Add To Cart

Question 1

How is an event type created from the search window? (select all that apply)

A : In the top right corner, click Save As > Event Type.

B : In an event's detail dropdown, click Event Actions > Build Event Type.

C : Edit eventtypes.conf and add a new stanza.

D : Add | eventtype to the SPL and execute the search.

Answer: A,C

Question 2

Which of the following is true about the Splunk Common Information Model (CIM)?

A : The data models included in the CIM are configured with data model acceleration turned off.

B : The CIM contains 28 pre-configured datasets.

C : The CIM is an app that needs to run on the indexer.

D : The data models included in the CIM are configured with data model acceleration turned on.

Answer: D

Question 3

Which option of the transaction command would be used to specify the maximum time between events in a transaction?

A : maxpause

B : maxspan

C : duration

D : eventcount

Answer: A

Question 4

What is the correct way to name a macro with two arguments?

A : us_sales2

B : us_sales(1,2)

C : us_sale,2

D : us_sales(2)

Answer: D

Question 5

This is what Splunk uses to categorize the data that is being indexed.

A : sourcetype

B : index

C : source

D : host

Answer: A

Page: 1 / 60

Total 300 Questions | Updated On: Mar 25, 2025

Add To Cart