厳密検証されたSPLK-1002日本語試験問題集と解答で無料提供のSPLK-1002日本語問題と正解付き
あなたを合格させるSPLK-1002日本語問題集で無料最新Splunk練習テスト
質問 # 155
フィールド値を使用して二次検索を実行するワークフローはどれですか？
- A. アクション
- B. 検索
- C. サブ検索
- D. POST
正解：B
解説：
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/CreateworkflowactionsinSplunkWeb
質問 # 156
transactionコマンドを使用すると、複数のソース間でイベントを__________できます
- A. 持続する
- B. 重複
- C. タグ
- D. 相関
正解：D
解説：
The transaction command allows you to correlate events across multiple sources. The transaction command is
a search command that allows you to group events into transactions based on some common characteristics,
such as fields, time, or both. A transaction is a group of events that share one or more fields that relate them to
each other. A transaction can span across multiple sources or sourcetypes that have different formats or
structures of data. The transaction command can help you correlate events across multiple sources by using the
common fields as the basis for grouping. The transaction command can also create some additional fields for
each transaction, such as duration, eventcount, startime, etc.
質問 # 157
次のアクションのうち、evalコマンドで実行できるのはどれですか？
- A. 1つ以上のフィールドでトランザクションをグループ化します。
- B. 結果からフィールドを削除します。
- C. 既存のフィールドを作成または置換します。
- D. 他の検索で再利用するためにSPLコマンドを保存します。
正解：C
質問 # 158
次の eval コマンドのうち、src からのホストに新しい値が提供されるのはどれですか (存在する場合)。
- A. | eval host = if (isnotnull (src), src, host)
- B. | eval host = if (NOT src = host, src, host)
- C. | eval host = if (isnu11 (src), src, host)
- D. | eval host = if (src = host, src, host)
正解：A
解説：
The eval command is a Splunk command that allows you to create or modify fields using expressions .
The if function is an expression that evaluates a condition and returns a value based on whether the condition is true or false. The syntax of the if function is if(X,Y,Z), where X is the condition, Y is the value to return if X is true, and Z is the value to return if X is false.
The isnotnull function is an expression that returns true if the argument is not null, and false otherwise. The syntax of the isnotnull function is isnotnull(X), where X is the argument to check.
Therefore, the expression if (isnotnull (src), src, host) returns the value of src if it is not null, and the value of host otherwise. This means that it will provide a new value for host from src if it exists, and keep the original value of host otherwise.
質問 # 159
検索ワークフローアクションを作成する場合、どのフィールドが必要ですか？
- A. データモデル名
- B. 権限設定
- C. 検索文字列
- D. 評価ステートメント
正解：C
解説：
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Setupasearchworkflowaction
A workflow action is a link that appears when you click an event field value in your search results2. A
workflow action can open a web page or run another search based on the field value2. There are two types of
workflow actions: GET and POST2. A GET workflow action appends the field value to the end of a URI and
opens it in a web browser2. A POST workflow action sends the field value as part of an HTTP request to a
web server2. When creating a Search workflow action, which is a type of GET workflow action that runs
another search based on the field value, the only required field is the search string2. The search string defines
the search that will be run when the workflow action is clicked2. Therefore, option A is correct, while options
B, C and D are incorrect because they are not required fields for creating a Search workflow action.
質問 # 160
次のイベントからポート番号を抽出するフィールド エクストラクターのメソッドはどれですか? |
10/20/2022 - 125.24.20.1 ++++ ポート 54 - ユーザー: admin <Web エラー>
- A. デリミタ
- B. フィールド抽出ツールは正規表現を抽出できません。
- C. 正規表現
- D. レックスコマンド
正解：D
解説：
The rex command allows you to extract fields from events using regular expressions. You can use the rex command to specify a named group that matches the port number in the event. For example:
rex "\+\+\+\+port (?<port>\d+)"
This will create a field called port with the value 54 for the event.
The delimiter method is not suitable for this event because there is no consistent delimiter between the fields. The regular expression method is not a valid option for the Field Extractor tool. The Field Extractor tool can extract regular expressions, but it is not a method by itself.
質問 # 161
以下に示すマクロ定義に基づいて、検索文字列でマクロを実行する正しい方法は何ですか？
- A. Convert_sales（$ euro、$€$、s79 $
- B. Convert_sales（$ euro、$€$、S、79 $）
- C. Convert_sales（euro、€、79） "
- D. Convert_sales（euro、€、.79）
正解：D
解説：
Reference:
The correct way to execute the macro in a search string is to use the format macro_name($arg1$, $arg2$, ...) where $arg1$, $arg2$, etc. are the arguments for the macro. In this case, the macro name is convert_sales and it takes three arguments: currency, symbol, and rate. The arguments are enclosed in dollar signs and separated by commas. Therefore, the correct way to execute the macro is convert_sales($euro$, $€$, .79).
質問 # 162
統計の代わりにトランザクションが使用されるのはどのような場合ですか?
- A. 計算の結果を確認します。
- B. 開始/終了値に基づいてイベントをグループ化します。
- C. より高速かつ効率的な検索を行うため。
- D. 単一のフィールド値に基づいてイベントをグループ化します。
正解：B
解説：
The transaction command is used to group events that are related by some common fields or conditions, such
as start/end values, time span, or pauses. The stats command is used to calculate statistics on a group of events
by a common field value.
References
Splunk Community
Splunk Transaction - Exact Details You Need
質問 # 163
トランザクション コマンドは生のイベントにどのフィールドを追加しますか? （該当するものをすべて選択）
- A. 持続時間
- B. カウント
- C. トランザクション ID
- D. イベント数
正解：A、C
解説：
Explanation
Hello, this is Bing. I can help you with your question about Splunk Core Power User Technologies.
The correct answers are B. duration and D. transaction id.
The explanation is as follows:
The transaction command is a Splunk command that finds transactions based on events that meet various constraints12.
Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member12.
The transaction command adds some fields to the raw events that are part of the transaction123. These fields are:
duration: The difference, in seconds, between the timestamps for the first and last events in the transaction123.
eventcount: The number of events in the transaction123.
transaction_id: A unique identifier for each transaction3. This field is useful for filtering or joining transactions3.
Therefore, the fields that the transaction command adds to the raw events are duration and transaction_id, which are options B and D in your question.
質問 # 164
アラートスロットリングは_______に使用されます。
- A. 各アラートを確認します
- B. 重大度を確認します
- C. アラートで自分自身をスパムするのをやめましょう
- D. 検索リクエストを時系列でずらす
正解：C
質問 # 165
フィールドサイドバーでこれを選択すると、検索結果がレアコマンドに自動的にパイプされます
- A. まれな値
- B. このフィールドのイベント
- C. 上位値
- D. 時間別の上位値
正解：A
解説：
The fields sidebar is a panel that shows the fields that are present in your search results2. The fields sidebar has two sections: selected fields and interesting fields2. Selected fields are fields that you choose to display in your search results by clicking on them in the fields sidebar or by using the fields command2. Interesting fields are fields that appear in at least 20 percent of events or have high variability among values2. For each field in the fields sidebar, you can select one of the following options: events with this field, rare values, top values by time or top values2. If you select rare values, Splunk will automatically pipe your search results to the rare command, which shows the least common values of a field2. Therefore, option B is correct, while options A, C and D are incorrect because they do not pipe your search results to the rare command.
質問 # 166
これは、Splunkがインデックス付けされているデータを分類するために使用するものです。
- A. インデックス
- B. ホスト
- C. ソース
- D. ソースタイプ
正解：D
質問 # 167
計算フィールドでソースとして使用できるオブジェクトは次のうちどれですか?
- A. タグフィールド。
- B. フィールドの別名。
- C. 自動検索によって追加されたフィールド。
- D. イベントタイプフィールド。
正解：C
解説：
The correct answer is B. A field added by an automatic lookup.
A calculated field is a field that is added to events at search time by using an eval expression. A calculated
field can use the values of two or more fields that are already present in the events to perform calculations.A
calculated field can use any field as a source, as long as the field is extracted before the calculated field is
defined1.
An automatic lookup is a way to enrich events with additional fields from an external source, such as a CSV
file or a database.An automatic lookup can add fields to eventsbased on the values ofexisting fields, such as
host, source, sourcetype, or any other extracted field2.An automatic lookup is performed before the calculated
fields are defined, so the fields added by the lookup can be used as sources for the calculated fields3.
Therefore, a calculated field can use a field added by an automatic lookup as a source.
References:
About calculated fields
About lookups
Search time processing
質問 # 168
トランザクション コマンドを使用する場合、排除されたトランザクションはどのように識別されますか?
- A. open_txn フィールドは 1 または true に設定されます。
- B. Txn_field は 1 または true に設定されます。
- C. Closed_txn フィールドが o または false に設定されます。
- D. Max_txn フィールドが O または false に設定されます。
正解：C
解説：
The transaction command is a Splunk command that finds transactions based on events that meet various constraints1.
Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member1.
The transaction command adds some fields to the raw events that are part of the transaction12. These fields are:
duration: The difference, in seconds, between the timestamps for the first and last events in the transaction12.
eventcount: The number of events in the transaction12.
closed_txn: A Boolean field that indicates whether the transaction is closed or evicted2. A transaction is closed if it meets one of the following conditions: maxevents, maxpause, maxspan, or startswith2. A transaction is evicted if it does not meet any of these conditions and exceeds the memory limit specified by maxopentxn or maxopenevents23.
Therefore, evicted transactions can be distinguished from non-evicted transactions by checking the value of the closed_txn field. The closed_txn field is set to 0, or false, for evicted transactions and 1, or true for non-evicted, or closed, transactions23.
質問 # 169
次の検索を考えてみましょう。
インデックス=ウェブソースタイプ=アクセスコラビネッド
ログには、同じ jsesszonid 値 (SD462K101O2F267) を共有する複数のイベントが表示されます。イベントをグループとして表示します。
次のリストのうち、jSSESSIONID 別にイベントをグループ化する検索はどれですか。
- A. index=web sourcetype=access_combined | highlight JSESSIONID | search SD462K101O2F267
- B. index=web sourcetype=access_combined JSESSTONID <SD4€2K101O2F267>
- C. index=web sourcetype=access_combined SD462K101O2F267 | table JSESSIONID
- D. index=web sourcetype=access_combined I transaction JSESSZONID I search SD462K101C2F267
正解：D
解説：
The transaction command groups events that share a common value in a specified field, such as JSESSIONID, and that occur within a specified time range. The search command filters the results to show only the events that match the given value of JSESSIONID. This search groups the events by JSESSIONID and then shows only the events that have the value SD462K101C2F267 for JSESSIONID2
1: Splunk Core Certified Power User Track, page 9. 2: Splunk Documentation, transaction command.
質問 # 170
次のステートメントのうち、フィールドエイリアスについて説明しているのはどれですか？
- A. 検索の一部として使用する場合、フィールドエイリアス名では大文字と小文字が区別されません。
- B. フィールドエイリアスは、ソースとソースタイプ間でのみデータを正規化します。
- C. フィールドエイリアスはルックアップファイル定義で使用できます。
- D. フィールドエイリアス名が元のフィールド名を置き換えます。
正解：C
解説：
Field aliases are alternative names for fields in Splunk. Field aliases can be used to normalize data across different sources and sourcetypes that have different field names for the same concept. For example, you can create a field alias for src_ip that maps to clientip, source_address, or any other field name that represents the source IP address in different sourcetypes. Field aliases can also be used in lookup file definitions to map fields in your data to fields in the lookup file. For example, you can use a field alias for src_ip to map it to ip_address in a lookup file that contains geolocation information for IP addresses. Field alias names do not replace the original field name, but rather create a copy of the field with a different name. Field alias names are case sensitive when used as part of a search, meaning that src_ip and SRC_IP are different fields.
質問 # 171
返される最も早いイベントと最も遅いイベントの間の最大合計時間を設定するには、transactionコマンドでどの関数を使用する必要がありますか？
- A. で終わる
- B. maxduration
- C. maxpause
- D. maxspan
正解：D
解説：
The maxspan function of the transaction command allows you to set the maximum total time between the
earliest and latest events returned. The maxspan function is an argument that can be used with the transaction
command to specify the start and end constraints for the transactions. The maxspan function takes a time
modifier as its value, such as 30s, 5m, 1h, etc. The maxspan function sets the maximum time span between the
first and last events in a transaction. If the time span between the first and last events exceeds the maxspan
value, the transaction will be split into multiple transactions.
質問 # 172
元のフィールドに基づいてフィールドエイリアスが作成されました。次に、変換コマンドを使用しない検索がスマートモードで実行されます。結果に表示されるフィールド名はどれですか？
- A. 両方が[すべてのフィールド]リストに表示されますが、検索でエイリアスが指定されている場合に限ります。
- B. 両方とも[興味深いフィールド]リストに表示されますが、イベントの少なくとも20パーセントに表示される場合に限ります。
- C. 元のフィールドは[すべてのフィールド]リストにのみ表示され、エイリアスは[興味深いフィールド]リストにのみ表示されます。
- D. エイリアスは[すべてのフィールド]リストにのみ表示され、元のフィールドは[興味深いフィールド]リストにのみ表示されます。
正解：B
解説：
A field alias is a way to assign an alternative name to an existing field without changing the original field
name or value2. You can use field aliases to make your field names more consistent or descriptive across
different sources or sourcetypes2. When you run a search without any transforming commands in Smart Mode,
Splunk automatically identifies and displays interesting fields in your results2. Interesting fields are fields that
appear in at least 20 percent of events or have high variability among values2. If you have created a field alias
based on an original field, both the original field name and the alias name will appear in the Interesting Fields
list if they meet these criteria2. However, only one of them will appear in each event depending on which one
you have specified in your search string2. Therefore, option B is correct, while options A, C and D are
incorrect.
質問 # 173
計算フィールドは、次のうちどれに基づいている可能性がありますか？
- A. 正規表現
- B. 検索文字列内で生成されたフィールド
- C. ルックアップテーブル
- D. 抽出されたフィールド
正解：D
解説：
As mentioned before, a calculated field is a field that you create based on the value of another field or fields2. A calculated field can be based on extracted fields, which are fields that are extracted from your raw data using various methods such as regular expressions, delimiters or key-value pairs2. Therefore, option B is correct, while options A, C and D are incorrect because they are not types of fields that a calculated field can be based on.
質問 # 174
データモデルは、次のデータセットの1つ以上で構成されていますか？ （該当するものをすべて選択。）
- A. イベント、トランザクション、検索データセットの子
- B. トランザクションデータセット
- C. データセットを検索する
- D. イベントデータセット
正解：B、C、D
解説：
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutdatamodels
Data models are collections of datasets that represent your data in a structured and hierarchical way. Data
models define how your data is organized into objects and fields. Data models can be composed of one or
more of the following datasets:
Events datasets: These are the base datasets that represent raw events in Splunk. Events datasets can be filtered
by constraints, such as search terms, sourcetypes, indexes, etc.
Search datasets: These are derived datasets that represent the results of a search on events or other datasets.
Search datasets can use any search command, such as stats, eval, rex, etc., to transform the data.
Transaction datasets: These are derived datasets that represent groups of events that are related by fields, time,
or both. Transaction datasets can use the transaction command or event types with transactiontype=true to
create transactions.
質問 # 175
次の変換コマンドのうち、トランザクションで使用できるものはどれですか?
- A. チャート、タイムチャート、統計、イベント統計
- B. チャート、タイムチャート、統計、差分
- C. チャート、タイムハート、データモデル、ピボット
- D. チャート、タイムチャット、統計、ピボット
正解：A
解説：
The correct answer is A. chart, timechart, stats, eventstats.
Transforming commands are commands that change the format of the search results into a table or a chart.
They can be used to perform statistical calculations, create visualizations, or manipulate data in various ways1.
Transactions are groups of events that share some common values and are related in some way. Transactions can be defined by using the transaction command or by creating a transaction type in the transactiontypes.conf file2.
Some transforming commands can be used with transactions to create tables or charts based on the transaction fields. These commands include:
* chart: This command creates a table or a chart that shows the relationship between two or more fields. It
* can be used to aggregate values, count occurrences, or calculate statistics3.
* timechart: This command creates a table or a chart that shows how a field changes over time. It can be used to plot trends, patterns, or outliers4.
* stats: This command calculates summary statistics on the fields in the search results, such as count, sum, average, etc. It can be used to group and aggregate data by one or more fields5.
* eventstats: This command calculates summary statistics on the fields in the search results, similar to stats, but it also adds the results to each event as new fields. It can be used to compare events with the overall statistics.
These commands can be applied to transactions by using the transaction fields as arguments. For example, if you have a transaction type named "login" that groups events based on the user field and has fields such as duration and eventcount, you can use the following commands with transactions:
* | chart count by user : This command creates a table or a chart that shows how many transactions each user has.
* | timechart span=1h avg(duration) by user : This command creates a table or a chart that shows the average duration of transactions for each user per hour.
* | stats sum(eventcount) as total_events by user : This command creates a table that shows the total number of events for each user across all transactions.
* | eventstats avg(duration) as avg_duration : This command adds a new field named avg_duration to each transaction that shows the average duration of all transactions.
The other options are not valid because they include commands that are not transforming commands or cannot be used with transactions. These commands are:
* diff: This command compares two search results and shows the differences between them. It is not a transforming command and it does not work with transactions.
* datamodel: This command retrieves data from a data model, which is a way to organize and categorize data in Splunk. It is not a transforming command and it does not work with transactions.
* pivot: This command creates a pivot report, which is a way to analyze data from a data model using a graphical interface. It is not a transforming command and it does not work with transactions.
References:
* About transforming commands
* About transactions
* chart command overview
* timechart command overview
* stats command overview
* [eventstats command overview]
* [diff command overview]
* [datamodel command overview]
* [pivot command overview]
質問 # 176
トランザクションはいつ使用する必要がありますか？
- A. イベントをグループ化すると、各グループに1000を超えるイベントが発生します。
- B. 1つ以上のフィールドから結果を計算する場合。
- C. イベントのグループ化が開始/終了値に基づいている場合。
- D. 大規模な分散Splunk環境でのみ。
正解：C
質問 # 177
次の検索を考えてみましょう。
インデックス=Web ソースタイプ=access_combined
ログには、同じ JSESSIONID 値 (SD470K92802F117) を共有する複数のイベントが表示されます。イベントをグループとして表示します。
次のリストから、JSESSIONID ごとにイベントをグループ化する検索はどれですか?
- A. index=web sourcetype=access_combined JSESSIONID <SD470K92802F117>
- B. index=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117
- C. index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117
- D. index=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID
正解：C
解説：
To group events by JSESSIONID, the correct search is index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117 (Option B). The transaction command groups events that share the same JSESSIONID value, allowing for the analysis of all events associated with a specific session as a single transaction. The subsequent search for SD470K92802F117 filters these grouped transactions to include only those related to the specified session ID.
質問 # 178
計算フィールドは、次のうちどれに基づくことができますか？
- A. タグ
- B. ルックアップの出力フィールド
- C. 抽出されたフィールド
- D. 検索文字列から生成されたフィールド
正解：C
解説：
"Calculated fields can reference all types of field extractions and field aliasing, but they cannot reference
lookups, event types, or tags."
質問 # 179
次のナレッジオブジェクトのうち、eval式の出力を表すものはどれですか？
- A. 計算されたルックアップ
- B. 計算フィールド
- C. フィールド抽出
- D. 評価フィールド
正解：B
解説：
Reference: https://docs.splunk.com/Splexicon:Calculatedfield
質問 # 180
......
無料でゲット！高評価Splunk SPLK-1002日本語試験問題集今すぐダウンロード！：https://jp.fast2test.com/SPLK-1002J-premium-file.html