Splunk SPLK-1002 Exam Questions & Answers

Correct Answer: B

The search string below returns events from the data model named Application_State.

| datamodel Application_State All_Application_State search The search string does the following:

It uses the datamodel command to access a data model in Splunk. The datamodel command takes two arguments: the name of the data model and the name of the dataset within the data model. It specifies the name of the data model as

Application_State. This is a predefined data model in Splunk that contains information about web applications. It specifies the name of the dataset as All_Application_State. This is a root dataset in the data model that contains all events from

all child datasets. It uses the search command to filter and transform the events from the dataset. The search command can use any search criteria or command to modify the results.

Therefore, the search string returns events from the data model named Application_State.

Correct Answer: C

The following search would create a graph similar to the one below:

index_internal sourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status

The search does the following:

It uses index_internal to specify the internal index that contains Splunk logs and metrics.

It uses sourcetype=Savesplunker to filter events by the sourcetype that indicates the Splunk Enterprise Security app.

It uses fields sourcetype, status to keep only the sourcetype and status fields in the events.

It uses transaction status maxspan=1d to group events into transactions based on the status field with a maximum time span of one day between the first and last events in a transaction. It uses timechart count by status to create a time-

based chart that shows the count of transactions for each status value over time.

The graph shows the following:

It is a line graph with two lines, one yellow and one blue. The x-axis is labeled with dates from Wed, Apr 4, 2018 to Tue, Apr 10, 2018.

The y-axis is labeled with numbers from 0 to 15.

The yellow line represents "shipped" and the blue line represents "success". The yellow line has a steady increase from 0 to 15, while the blue line has a sharp increase from 0 to 5, then a decrease to 0, and then a sharp increase to 10.

The graph is titled "Type".

Therefore, option C is the correct answer.

Correct Answer: C