結果を保証するには最新2025年04月無料Splunk SPLK-1002日本語で練習しよう
有効な問題最新版を無料で試そうSPLK-1002日本語試験問題集解答
質問 # 79
次の検索コントロールのうち、検索を再実行しないのはどれですか？ （該当するものをすべて選択。）
- A. ズームアウト
- B. 選択を解除
- C. タイムラインでバーの範囲を選択する
- D. タイムラインでバーを選択する
正解：B、C、D
解説：
The timeline is a graphical representation of your search results that shows the distribution of events over time2. You can use the timeline to zoom in or out of a specific time range or to select one or more bars on the timeline to filter your results by that time range2. However, these actions will not re-run the search, but rather refine the existing results based on the selected time range2. Therefore, options B, C and D are correct, while option A is incorrect because zooming out will re-run the search with a broader time range.
質問 # 80
次の検索のうち、以下のようなグラフを作成するのはどれですか？
- A. index_internal seourcetype = Savesplunker |フィールドsourcetype、status |トランザクションステータスmaxspan-id |ステータス別のタイムチャートカウント
- B. index_internal seourcetype = Savesplunker |フィールドsourcetype、status |トランザクションステータスmaxspan-id |時間ごとのチャートカウント状態
- C. これらの検索はどれも類似グラフを生成しません。
- D. index_internal seourcetype = Savesplunker |フィールドsourcetype、status |トランザクションステータスmaxspan-id |カウント状態の開始
正解：A
解説：
The following search would create a graph similar to the one below:
index_internal sourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan=1d | timechart
count by status
The search does the following:
It uses index_internal to specify the internal index that contains Splunk logs and metrics.
It uses sourcetype=Savesplunker to filter events by the sourcetype that indicates the Splunk Enterprise
Security app.
It uses fields sourcetype, status to keep only the sourcetype and status fields in the events.
It uses transaction status maxspan=1d to group events into transactions based on the status field with a
maximum time span of one day between the first and last events in a transaction.
It uses timechart count by status to create a time-based chart that shows the count of transactions for
each status value over time.
The graph shows the following:
It is a line graph with two lines, one yellow and one blue.
The x-axis is labeled with dates from Wed, Apr 4, 2018 to Tue, Apr 10, 2018.
The y-axis is labeled with numbers from 0 to 15.
The yellow line represents "shipped" and the blue line represents "success".
The yellow line has a steady increase from 0 to 15, while the blue line has a sharp increase from 0 to 5,
then a decrease to 0, and then a sharp increase to 10.
The graph is titled "Type".
Therefore, option C is the correct answer.
質問 # 81
検索を完了します、.... | _____失敗>成功
- A. もし
- B. 上記のいずれか
- C. 検索
- D. どこ
正解：D
質問 # 82
マクロはどの設定セクションで定義されますか?
- A. 検索、レポート、アラート
- B. 詳細検索
- C. トークン
- D. フィールド
正解：B
質問 # 83
evalコマンドtostring関数で使用できるのは次のうちどれですか（該当するものをすべて選択してください）
- A. ''期間 ''
- B. '' 10進数 ''
- C. '' hex ''
- D. ''コンマ ''
正解：A、C、D
解説：
https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/ConversionFunctions#tostring.28X.2CY.29 The tostring function in the eval command converts a numeric value to a string value. It can take an optional second argument that specifies the format of the string value. Some of the possible formats are:
hex: converts the numeric value to a hexadecimal string.
commas: adds commas to separate thousands in the numeric value.
duration: converts the numeric value to a human-readable duration string, such as "2h 3m 4s".
Therefore, the formats A, B, and D can be used with the tostring function.
質問 # 84
データモデルとピボットの関係は何ですか？
- A. ピボットとデータモデルは同じものです。
- B. データモデルはピボットのデータセットを提供します。
- C. ピボットはデータモデルのデータセットを提供します。
- D. ピボットとデータモデルには関係がありません。
正解：B
解説：
The relationship between data models and pivots is that data models provide the datasets for pivots. Data models are collections of datasets that represent your data in a structured and hierarchical way. Data models define how your data is organized into objects and fields. Pivots are user interfaces that allow you to create data visualizations that present different aspects of a data model. Pivots let you select options from menus and forms to create charts, tables, maps, etc., without writing any SPL code. Pivots use datasets from data models as their source of data. Pivots and data models are not the same thing, as pivots are tools for visualizing data models. Pivots do not provide datasets for data models, but rather use them as inputs.
Therefore, only statement A is true about the relationship between data models and pivots.
質問 # 85
制限属性は___________。
- A. トップコマンドでのみ機能します
- B. デフォルトの10をオーバーライドします
- C. デフォルトの20をオーバーライドします
- D. デフォルトの15をオーバーライド
正解：B
質問 # 86
次の検索モードのうち、抽出されたすべてのフィールドがフィールド サイドバーに自動的に返されるのはどれですか。
- A. 詳細
- B. 速い
- C. 賢い
正解：A
解説：
The search modes determine how Splunk processes your search and displays your results2. There are three search modes: Fast, Smart and Verbose2. The search mode that automatically returns all extracted fields in the fields sidebar is Verbose2. The Verbose mode shows all the fields that are extracted from your events, including default fields, indexed fields and search-time extracted fields2. The fields sidebar is a panel that shows the fields that are present in your search results2. Therefore, option C is correct, while options A and B are incorrect because they are not search modes that automatically return all extracted fields in the fields sidebar.
質問 # 87
productName フィールドと product:d フィールドに特定のイベントの値がある場合、どのフィールドがフィールドに入力されるでしょうか?
- A. 両方のフィールド値が使用され、製品 INFO フィールドは指定されたイベントの複数値フィールドになります。
- B. 2 番目に表示されるフィールドの値。
- C. どちらのフィールド値も使用されず、指定されたイベントに対してフィールドに NULL 値が割り当てられます。
- D. | eval productINFO=coalesco(productName,productid)
- E. 最初に表示される productName フィールドの値。
正解：A
解説：
The correct answer is B. The value for the productName field because it appears first.
The coalesce function is an eval function that takes an arbitrary number of arguments and returns the first value that is not null. A null value means that the field has no value at all, while an empty value means that the field has a value, but it is "" or zero-length1.
The coalesce function can be used to combine fields that have different names but represent the same data, such as IP address or user name. The coalesce function can also be used to rename fields for clarity or convenience2.
The syntax for the coalesce function is:
coalesce(<field1>,<field2>,...)
The coalesce function will return the value of the first field that is not null in the argument list. If all fields are null, the coalesce function will return null.
For example, if you have a set of events where the IP address is extracted to either clientip or ipaddress, you can use the coalesce function to define a new field called ip, that takes the value of either clientip or ipaddress, depending on which is not null:
| eval ip=coalesce(clientip,ipaddress)
In your example, you have a set of events where the product name is extracted to either productName or productid, and you use the coalesce function to define a new field called productINFO, that takes the value of either productName or productid, depending on which is not null:
| eval productINFO=coalesce(productName,productid)
If both productName and productid fields have values for a given event, the coalesce function will return the value of the productName field because it appears first in the argument list. The productid field will be ignored by the coalesce function.
Therefore, the value for the productName field will be used to populate the productINFO field if both fields have values for a given event.
Reference:
Search Command> Coalesce
USAGE OF SPLUNK EVAL FUNCTION : COALESCE
質問 # 88
GETワークフローアクションを作成するために必要な情報には、次のうちどれが含まれますか？ （該当するものをすべて選択。）
- A. ユーザーが検索時に誘導されるURI。
- B. 検索時に[イベントアクション]メニューに表示されるラベル。
- C. 検索時にユーザーが誘導されるURIの名前。
- D. ワークフローアクションの名前
正解：A、B、D
解説：
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/SetupaGETworkflowaction Information needed to create a GET workflow action includes the following: a name of the workflow action, a URI where the user will be directed at search time, and a label that will appear in the Event Action menu at search time. A GET workflow action is a type of workflow action that performs a GET request when you click on a field value in your search results. A GET workflow action can be configured with various options, such as:
A name of the workflow action: This is a unique identifier for the workflow action that is used internally by Splunk. The name should be descriptive and meaningful for the purpose of the workflow action.
A
URI where the user will be directed at search time: This is the base URL of the external web service or application that will receive the GET request. The URI can include field value variables that will be replaced by the actual field values at search time. For example, if you have a field value variable ip, you can write it as
http://example.com/ip=$ip to send the IP address as a parameter to the external web service or application.
A label that will appear in the Event Action menu at search time: This is the display name of the workflow action that will be shown in the Event Action menu when you click on a field value in your search results. The label should be clear and concise for the user to understand what the workflow action does.
Therefore, options A, B, and C are correct.
質問 # 89
ユーザーは、各販売地域における各製品の合計収益を表示するテーブルを必要としています。使用する適切な SPL クエリはどれでしょうか?
- A. index=X sourcetype=Y | 価格と地域による商品の合計チャート
- B. index=X | 製品、地域別のチャート合計(価格)
- C. index=X | 製品、地域別のチャート合計(価格)
- D. index=X | 地域別の価格に対する商品の合計をグラフで表す
正解：C
解説：
The chart command with sum(price) by product, region will return a table where the total revenue (price) is aggregated (sum) for each product and sales region. This is the correct way to aggregate data in Splunk.
References:
Splunk Docs - chart command
質問 # 90
タグに関する次の説明のうち、正しいものはどれですか。
- A. タグはインデックス時に作成されます。
- B. タグでは大文字と小文字は区別されません。
- C. タグを使用すると、データをより理解しやすくなります。
- D. タグは構文タグを使用して検索されます:: <fieldneme>
正解：C
解説：
Tags are aliases or alternative names for field values in Splunk. They can make your data more understandable
by using common or descriptive terms instead of cryptic or technical terms. For example, you can tag a field
value such as "200" with "OK" or "success" to indicate that it is a HTTP status code for a successful request.
Tags are case sensitive, meaning that "OK" and "ok" are different tags. Tags are created at search time,
meaning that they are applied when you run a search on your data. Tags are searched by using the
syntax tag::<tagname>, where <tagname> is the name of the tag you want to search for.
質問 # 91
evalコマンドの「if」関数には、次の3つの引数が（順番に）必要です。
- A. trueの場合の結果、falseの場合の結果、ブール式
- B. ブール式、trueの場合は結果、falseの場合は結果
- C. falseの場合の結果、trueの場合の結果、ブール式
- D. ブール式、falseの場合は結果、trueの場合は結果
正解：B
解説：
The eval command 'if' function requires the following three arguments (in order): boolean expression, result if
true, result if false. The eval command is a search command that allows you to create new fields or modify
existing fields by performing calculations or transformations on them. The eval command can use various
functions to perform different operations on fields. The 'if' function is one of the functions that can be used
with the eval command to perform conditional evaluations on fields. The 'if' function takes three arguments: a
boolean expression that evaluates to true or false, a result that will be returned if the boolean expression is true,
and a result that will be returned if the boolean expression is false. The 'if' function returns one of the two
results based on the evaluation of the boolean expression.
質問 # 92
ほとんどの大規模なSplunk環境では、フィールドごとにイベントをグループ化するために使用できる最も効率的なコマンドは何ですか/
- A. streamstats
- B. トランザクション
- C. 参加する
- D. 統計
正解：D
解説：
https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Abouttransactions
In other cases, it's usually better to use the stats command, which performs more efficiently, especially in a
distributed environment. Often there is a unique ID in the events and stats can be used.
質問 # 93
次の検索は何をしますか？
- A. ユーザーの総数とアメリカンドッグごとの分割のテーブルを作成します。
- B. ユーザーごとに分割されたミステリーアメリカンドッグの総数のテーブルを作成します。
- C. 菜食主義のアメリカンドッグごとにユーザーの総数をグループ化するテーブルを作成します。
- D. 食べたすべての種類のアメリカンドッグの数をユーザーごとに分けて表を作成します。
正解：B
質問 # 94
タグに関する次の記述のうち、正しいものはどれですか? （該当するものをすべて選択。）
- A. タグはデータをより理解しやすくするために設計されています。
- B. タグでは大文字と小文字が区別されません。
- C. タグは検索に基づいてイベントを分類します。
- D. タグはフィールドと値のペアに基づいています。
正解：A、D
解説：
The following statements about tags are true: tags are based on field/value pairs and tags categorize events based on a search. Tags are custom labels that can be applied to fields or field values to provide additional context or meaning for your data. Tags can be used to filter or analyze your data based on common concepts or themes. Tags can be created by using various methods, such as search commands, configuration files, user interfaces, etc. Some of the characteristics of tags are:
Tags are based on field/value pairs: This means that tags are associated with a specific field name and a specific field value. For example, you can create a tag called "alert" for the field name "status" and the field value "critical". This means that only events that have status=critical will have the "alert" tag applied to them.
Tags categorize events based on a search: This means that tags are defined by a search string that matches the events that you want to tag. For example, you can create a tag called "web" for the search string sourcetype=access_combined. This means that only events that match the search string sourcetype=access_combined will have the "web" tag applied to them.
The following statements about tags are false: tags are case-insensitive and tags are designed to make data more understandable. Tags are case-sensitive and tags are designed to make data more searchable. Tags are case-sensitive: This means that tags must match the exact case of the field name and field value that they are associated with. For example, if you create a tag called "alert" for the field name "status" and the field value "critical", it will not apply to events that have status=CRITICAL or Status=critical. Tags are designed to make data more searchable: This means that tags can help you find relevant events or patterns in your data by using common concepts or themes. For example, if you create a tag called "web" for the search string sourcetype=access_combined, you can use tag=web to find all events related to web activity.
質問 # 95
ピボット ツールで使用されるデータ セットについて正しいのは次のうちどれですか。
- A. 保存されたレポートからのみ作成できます。
- B. サマリー インデックスからのみ作成できます。
- C. 管理者ロールを持つユーザーのみが作成できます。
- D. データ モデルからのみ作成できます。
正解：D
解説：
In Splunk, data sets used in the Pivot tool are derived from data models. The Pivot tool allows users to create reports and visualizations based on the structured information available in data models.
Reference:
Splunk Docs - Pivot tool
質問 # 96
フィールド抽出ユーティリティでは、このボタンは抽出されたフィールドを含まないイベントを表示します。
あなたの答えを選択してください。
- A. 選択済み-フィールド
- B. 一致
- C. 不一致
- D. 非抽出
正解：C
解説：
Explanation
The Field Extractor Utility (FX) is a tool that helps you extract fields from your events using a graphical interface or by manually editing the regular expression2. The FX has a button that displays events that do not contain extracted fields, which is the Non-Matches button2. The Non-Matches button shows you the events that do not match the regular expression that you have defined for your field extraction2. This way, you can check if your field extraction is accurate and complete2. Therefore, option B is correct, while options A, C and D are incorrect because they are not buttons that display events that do not contain extracted fields.
質問 # 97
ワークフローアクションでフィールド値変数を使用する場合、どの句読点がデータをエスケープしますか
- A. ＃
- B. *
- C. ^
- D. ！
正解：D
解説：
When using a field value variable with a Workflow Action, the exclamation mark (!) will escape the data. A Workflow Action is a custom action that performs a task when you click on a field value in your search results. A Workflow Action can be configured with various options, such as label name, base URL, URI parameters, post arguments, app context, etc. A field value variable is a placeholder for the field value that will be used to replace the variable in the URL or post argument of the Workflow Action. A field value variable is written as fieldname, where field_name is the name of the field whose value will be used. However, if the field value contains special characters that need to be escaped, such as spaces, commas, etc., you can use the exclamation mark (!) before and after the field value variable to escape the data. For example, if you have a field value variable host, you can write it as !$host! to escape any special characters in the host field value.
Therefore, option B is the correct answer.
質問 # 98
マクロ Weekly_sales (2) には、次の検索文字列が含まれています。
インデックス=ゲーム | eval ProductSales = $Price$ * $AmountSold$
結果を返すのは次のうちどれですか?
- A. '週間売上 (3.99, 10)'
- B. '週間売上 (3)'
- C. 'weekly_sales (3.99, 10)'
- D. 'weekly_sales($3.995, $108)'
正解：C
解説：
To use a search macro in a search string, you need to place a back tick character (`) before and after the macro
name1. You also need to use the same number of arguments as defined in the macro2. The macro weekly sales
(2) has two arguments:PriceandAmountSold. Therefore, you need to provide two values for these arguments
when you call the macro.
The option A is incorrect because it uses parentheses instead of back ticks around the macro name. The option
B is incorrect because it uses underscores instead of spaces in the macro name. The option D is incorrect
because it uses spaces instead of commas to separate the argument values.
Reference:1Use search macros in searches - Splunk Documentation2Define search macros in Settings - Splunk
Documentation
質問 # 99
この検索に当てはまる説明は次のうちどれですか。 （該当するものをすべて選択してください。）検索：sourcetype = access * | fields action productld status
- A. 3列のテーブルを返します
- B. パフォーマンスを向上させるためにtableコマンドを使用する
- C. 検索語を含むすべてのイベントを探しています：フィールドANDアクションAND productldANDステータス
- D. フィールドが抽出される制限
正解：D
質問 # 100
コマンド | を含む検索で予想される結果は何ですか? ここでA=B?
- A. フィールドの値がフィールド B の値と等しいイベント。
- B. 文字列値 A=B を含むイベント。
- C. A=B の文字列値を含むイベント。
- D. フィールド A に文字列値 B が含まれるイベント。
正解：A
解説：
The correct answer is C. Events where values of field A are equal to values of field B.
The where command is used to filter the search results based on an expression that evaluates to true or false. The where command can compare two fields, two values, or a field and a value. The where command can also use functions, operators, and wildcards to create complex expressions1.
The syntax for the where command is:
| where <expression>
The expression can be a comparison, a calculation, a logical operation, or a combination of these. The expression must evaluate to true or false for each event.
To compare two fields with the where command, you need to use the field names without any quotation marks. For example, if you want to find events where the values for the field A match the values for the field B, you can use the following syntax:
| where A=B
This will return only the events where the two fields have the same value.
The other options are not correct because they use different syntax or fields that are not related to the where command. These options are:
A) Events that contain the string value where A=B: This option uses the string value where A=B as a search term, which is not valid syntax for the where command. This option will return events that have the literal text "where A=B" in them.
B) Events that contain the string value A=B: This option uses the string value A=B as a search term, which is not valid syntax for the where command. This option will return events that have the literal text "A=B" in them.
D) Events where field A contains the string value B: This option uses quotation marks around the value B, which is not valid syntax for comparing fields with the where command. Quotation marks are used to enclose phrases or exact matches in a search2. This option will return events where the field A contains the string value "B".
Reference:
where command usage
Search command cheatsheet
質問 # 101
......
SPLK-1002日本語ブレーン問題集PDF、Splunk SPLK-1002日本語試験問題詰合せ：https://jp.fast2test.com/SPLK-1002J-premium-file.html