Splunk Core Certified Advanced Power User - SPLK-1004 Free Exam Questions

A. Follow a lookup with an alert command in the search bar.

B. Use the lookup dropdown in the alert configuration window.

C. Upload a lookup file directly to the alert.

D. Run a search that uses a lookup and save as an alert.

A. makemv must be preceded by the rex command.

B. makemv must be preceded by the erex command.

C. It is specified by the delim argument.

D. It is specified by the tokenizer argument.

A. date_year

B. date_day

C. date_minute

D. date_zone

A. They require at least Power User role.

B. They create new searchable events.

C. They must be used with other alert actions.

D. They cannot use tokens to reference event fields.

A. Set a token to select a value from the time range picker.

B. Pass a token from a drilldown to modify index settings.

C. Run an eval statement based on a user clicking a value on a form.

D. Cancel all jobs based on the number of search job results captured.

A. The erex and rex commands cannot be used in conjunction under any circumstances.

B. The regex generated by the erex command can be edited and used with the erex command in a subsequent search.

C. The regex generated by the erex command can be edited and used with the rex command in a subsequent search.

D. The regex generated by the rex command can be edited and used with the erex command in a subsequent search.

A. Admin

B. Power

C. User

D. can_delete

A. Use accelerated data models.

B. Use scheduled reports.

C. Use base searches.

D. Use inline searches.

A. $row.$

B. $table.$

C. $rowclick.$

D. $tableclick.$

A. makemv

B. list

C. mvcombine

D. eval