Free Splunk Core Certified Power User practice test: 30 questions with answers

The maxpause option sets the largest allowed gap between consecutive events in a transaction, so a longer gap starts a new transaction. Stats returns one count per IP without grouping events, startswith defines a start event rather than a time gap, and dedup keeps only one event per IP.

Stats is a transforming command that can be distributed, which makes it lighter when aggregates such as counts or averages are enough. Transaction must assemble grouped raw events, and it is the right choice only when the grouped events themselves are needed; the other options reverse the roles or misdescribe the output.

The startswith and endswith options of transaction define the boundary events of each session, and transaction adds a duration field automatically. Stats with earliest and latest does not bound sessions by the login and logout words, maxevents limits the event count without using those words, and dedup removes repeated rows instead of grouping events into sessions.

The where command evaluates an expression that can compare two fields, so it keeps only the matching events. The search command matches keywords and literal field values and cannot compare two fields, dedup removes duplicate events, and table only chooses which columns to display.

The fillnull command replaces null values in the named field with the value given, here 0, and keeps every row. The where isnull filter keeps only the rows with missing values, dedup removes repeated values, and table only selects displayed columns without changing the blanks.

The where command evaluates expressions, including comparisons between two fields, and the search command can filter earlier results when it follows a pipe. The search command cannot compare two fields or call eval functions, and where does not have to be the first command in a search.

The Delimiters method extracts fields by splitting each event on a consistent character, and you name the fields in column order. Tags label existing field values, field aliases rename fields that already exist, and indexes.conf controls index storage rather than field extraction.

A regular expression extraction from the Field Extractor is a search-time definition that relies on named capture groups, and values are read from the raw event when a search runs. Index-time fields are stored in the index, calculated fields compute new values from existing fields, and field aliases only give an existing field another name.

The rex command defines a field inside a single search without saving any configuration, which fits a one-time task. A Field Extractor extraction is a permanent saved setting that the task does not need, a lookup enriches events from a table, and a field alias only renames a field that already exists.

A field alias is a search-time mapping that makes an existing field available under another name and leaves the raw data untouched. An index-time change alters what is stored, a tag only labels values, and an event type classifies events by search criteria without renaming any field.

Calculated fields use eval-style expressions that Splunk evaluates at search time, so they do not store values in the index or change raw events. The reindexing claim is wrong because calculated fields are search-time settings, and the other two options misdescribe what a calculated field produces.

A calculated field computes a new field from an eval expression and applies to the sourcetype automatically. A field alias only renames bytes and cannot divide it, a tag labels field values, and an event type classifies events by search criteria without creating a numeric field.

A tag is a label attached to specific field-value pairs, so searches can use the label instead of repeating the values. A field alias renames a field, a calculated field computes a new value, and a dashboard panel only displays results without labeling anything.

An event type stores a search definition that groups matching events under a name, and you search it with eventtype=name. Event types do not move data between indexes, rename fields, or require editing indexes.conf.

The eventtype field selects the events that match the event type, and host=vpn01 narrows those results to one host. A bare keyword searches for the word itself, tag= looks for a tag rather than an event type, and macro is not a search keyword.

A search macro stores reusable search text under a name, so a change made in the macro applies to every search that calls it. A lookup definition enriches events from a table, a field alias renames a field, and a workflow action builds a link or search from field values.

Splunk expands a macro when the search runs, and the call is written as the macro name inside backticks, with positional arguments in parentheses. The pipe-and-colon syntax, the macro keyword, and a props.conf entry are not valid ways to call a search macro.

Macro arguments are matched by position, so the first value fills $idx$ and the second fills $stype$. Name=value pairs are not supported in the call, omitting the second argument leaves the macro incomplete, and reversing the order puts the sourcetype into the index slot.

A GET workflow action opens a URL built from field values, which is what a link to an outside site needs. A POST workflow action submits data to a target system rather than a simple link, a Search workflow action runs a Splunk search instead of opening a website, and a tag labels values without creating any link.

A Search workflow action builds a new Splunk search from field values and runs it, so the analyst stays in Splunk. A GET action opens an external URL, a POST action submits data to a web service, and a calculated field creates another field without running any search.

A POST workflow action sends selected field values to a target URL in an HTTP POST request, which suits a ticketing API. A Search workflow action only runs a Splunk search, a field alias renames a field inside Splunk, and an event type classifies events without sending anything.

A data model is the dataset that pivot works from, and a root event object with a sourcetype constraint restricts it to the intended events. A lookup table enriches events, a macro only reuses search text, and a dashboard panel displays results without creating a dataset for pivot.

Pivot sum and average functions need a numeric attribute, and a string attribute supports only counting. Renaming and tagging do not change the data type, and a transaction object groups events rather than converting field types.

A data model organizes objects in a hierarchy, acceleration creates summaries for faster pivot and tstats searches, and child objects inherit the constraints of their parents. Data models do not replace indexes or remove stored raw events, and they can be created in Splunk Web without editing props.conf.

The CIM Add-On supplies field aliases, tags, event types, and data models that map source-specific names to CIM standard names, so one search can cover both sources. Rewriting raw logs is unnecessary, appended panels still use each source's own field names, and separate indexes keep the data apart rather than normalizing it.

The CIM Add-On delivers knowledge objects and data models that normalize fields, and its standard names let one search span several sources. It is not a forwarder rewrite tool, it does not replace data models with a separate index, and it does not change raw event text.

The tstats command reads the Authentication data model, whose CIM field names apply across sources, so one search covers every normalized source. The other searches depend on a single sourcetype's keywords or on fields that are not normalized, and one rename does not normalize data for all sources.

The timechart command places _time on the x-axis and buckets results by the span, so span=1h with count by datacenter gives an hourly line for each data center. The chart command with no time field has no time axis, top returns ranked values rather than a time series, and table lists rows without aggregating them.

Timechart is built around _time and span, while chart uses over for rows and by for columns. The first option reverses the two commands, the second wrongly limits timechart to counting, and the third is false because both are transforming commands that return aggregated results rather than events.

The chart command with count over category returns one row per category with its purchase count and no time axis. Timechart always places _time on the x-axis, table lists fields without aggregating them, and sort only reorders events without counting anything.