[2024年06月] を試そう！リアルSPLK-1002日本語問題集で100%無料SPLK-1002日本語試験問題集
SPLK-1002日本語のPDF問題集試験問題 有効なSPLK-1002日本語問題集
質問 # 34
GETワークフローアクションを作成するために必要な情報には、次のうちどれが含まれますか？ （該当するものをすべて選択。）
- A. ワークフローアクションの名前
- B. 検索時に[イベントアクション]メニューに表示されるラベル。
- C. 検索時にユーザーが誘導されるURIの名前。
- D. ユーザーが検索時に誘導されるURI。
正解：A、B、D
解説：
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/SetupaGETworkflowaction
Information needed to create a GET workflow action includes the following: a name of the workflow action, a
URI where the user will be directed at search time, and a label that will appear in the Event Action menu at
search time. A GET workflow action is a type of workflow action that performs a GET request when you click
on a field value in your search results. A GET workflow action can be configured with various options, such
as:
A name of the workflow action: This is a unique identifier for the workflow action that is used internally by
Splunk. The name should be descriptive and meaningful for the purpose of the workflow action.
A
URI where the user will be directed at search time: This is the base URL of the external web service or
application that will receive the GET request. The URI can include field value variables that will be replaced
by the actual field values at search time. For example, if you have a field value variable ip, you can write it as
http://example.com/ip=$ip to send the IP address as a parameter to the external web service or application.
A label that will appear in the Event Action menu at search time: This is the display name of the workflow
action that will be shown in the Event Action menu when you click on a field value in your search results. The
label should be clear and concise for the user to understand what the workflow action does.
Therefore, options A, B, and C are correct.
質問 # 35
データモデルフィールドは、自動抽出メソッドを使用して追加できます。次のステートメントのうち、自動抽出フィールドについて説明しているのはどれですか？ （該当するものをすべて選択）
- A. 自動抽出フィールドは、制約付きのデータセットにすでに存在する場合に追加できます。
- B. 自動抽出されたフィールドのデータ型を変更できます。
- C. 自動抽出されたフィールドには、ピボットで使用するためのわかりやすい名前を付けることができます。
- D. 自動抽出されたフィールドはピボットで非表示にできます。
正解：A、B、C、D
解説：
Explanation
Data model fields are fields that describe the attributes of a dataset in a data model2. Data model fields can be added using various methods such as Auto-Extracted, Evaluated or Lookup2. Auto-Extracted fields are fields that are automatically extracted from your raw data using various techniques such as regular expressions, delimiters or key-value pairs2. Auto-Extracted fields can be hidden in Pivot, which means that you can choose whether to display them or not in the Pivot interface2. Therefore, option A is correct. Auto-Extracted fields can have their data type changed, which means that you can specify whether they are strings, numbers, booleans or timestamps2. Therefore, option B is correct. Auto-Extracted fields can be given a friendly name for use in Pivot, which means that you can assign an alternative name to them that is more descriptive or user-friendly than the original field name2. Therefore, option C is correct. Auto-Extracted fields can be added if they already exist in the dataset with constraints, which means that you can include them in your data model even if they are already extracted from your raw data by applying filters or constraints to limit the scope of your dataset2. Therefore, option D is correct.
質問 # 36
Field Extractor（FX）はどの区切り文字を検出できますか？ （該当するものをすべて選択）
- A. タブ
- B. パイプ
- C. スペース
- D. カンマ
正解：B、C、D
解説：
Reference:
The Field Extractor (FX) is a tool that helps you extract fields from your data using delimiters or regular expressions. Delimiters are characters or strings that separate fields in your data. The FX can detect some common delimiters automatically, such as pipes (|), spaces ( ), commas (,), semicolons (;), etc. The FX cannot detect tabs (\t) as delimiters automatically, but you can specify them manually in the FX interface.
質問 # 37
マウスオーバーしてクリックすると、検索語thisが追加されます（これらのブール演算子は（暗黙的ではありません。（該当するものをすべて選択してください）。
- A. ない
- B. （）
- C. AND
- D. または
正解：A、B、D
解説：
Explanation
When you mouse over and click to add a search term from the Fields sidebar or from an event in your search results, Splunk automatically adds the term to your search string with an implied AND operator2. However, this does not apply to some Boolean operators such as OR, NOT and parentheses (). These operators are not implied when you add a search term and you have to type them manually if you want to use them in your search string2. Therefore, options A, B and D are correct, while option C is incorrect because AND is implied when you add a search term.
質問 # 38
ビジュアライゼーションを作成するときに使用されるコマンドは次のうちどれですか（該当するものをすべて選択してください）。
- A. iplocation
- B. コロプレス
- C. ジオスタット
- D. Geom
正解：A、C、D
解説：
The following commands are used when creating visualizations: geom, geostats, and iplocation.
Visualizations are graphical representations of data that show trends, patterns, or comparisons. Visualizations can have different types, such as charts, tables, maps, etc. Visualizations can be created by using various commands that transform the data into a suitable format for the visualization type. Some of the commands that are used when creating visualizations are:
* geom: This command is used to create choropleth maps that show geographic regions with different colors based on some metric. The geom command takes a KMZ file as an argument that defines the geographic regions and their boundaries. The geom command also takes a field name as an argument that specifies the metric to use for coloring the regions.
* geostats: This command is used to create cluster maps that show groups of events with different sizes
* and colors based on some metric. The geostats command takes a latitude and longitude field as arguments that specify the location of the events. The geostats command also takes a statistical function as an argument that specifies the metric to use for sizing and coloring the clusters.
* iplocation: This command is used to create location-based visualizations that show events with different attributes based on their IP addresses. The iplocation command takes an IP address field as an argument and adds some additional fields to the events, such as Country, City, Latitude, Longitude, etc. The iplocation command can be used with other commands such as geom or geostats to create maps based on IP addresses.
質問 # 39
次のオプションのうち、トランザクションの最初のイベントを定義するものはどれですか?
- A. startswith
- B. with
- C. startingwith
- D. firstevent
正解：A
解説：
The correct answer is A. startswith.
The explanation is as follows:
The transaction command is used to find transactions based on events that meet various constraints12.
Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member1.
The startswith option is used to define the first event in a transaction by specifying a search term or an expression that matches the event13.
For example, | transaction clientip JSESSIONID startswith="view" will create transactions based on the clientip and JSESSIONID fields, and the first event in each transaction will contain the term "view" in the _raw field2.
質問 # 40
タグに関する次の説明のうち、正しいものはどれですか。
- A. タグはインデックス時に作成されます。
- B. タグを使用すると、データをより理解しやすくなります。
- C. タグでは大文字と小文字は区別されません。
- D. タグは構文タグを使用して検索されます:: <fieldneme>
正解：B
解説：
Explanation
Tags are aliases or alternative names for field values in Splunk. They can make your data more understandable by using common or descriptive terms instead of cryptic or technical terms. For example, you can tag a field value such as "200" with "OK" or "success" to indicate that it is a HTTP status code for a successful request.
Tags are case sensitive, meaning that "OK" and "ok" are different tags. Tags are created at search time, meaning that they are applied when you run a search on your data. Tags are searched by using the syntax tag::<tagname>, where <tagname> is the name of the tag you want to search for.
質問 # 41
Splunk Common Information Model（CIM）は、異なる名前のフィールドを正規化するためにどの機能に依存していますか？
- A. フィールドエイリアス。
- B. 名前変更コマンド。
- C. CIMは、同じフィールドの異なる名前では機能しません。
- D. マクロ。
正解：A
解説：
Explanation
The Splunk Common Information Model (CIM) add-on helps you normalize your data from different sources and make it easier to analyze and report on it3. One of the functionalities that the CIM add-on relies on to normalize fields with different names is field aliases3. Field aliases allow you to assign an alternative name to an existing field without changing the original field name or value2. By using field aliases, you can map different field names from different sources or sourcetypes to a common field name that conforms to the CIM standard3. Therefore, option B is correct, while options A, C and D are incorrect.
質問 # 42
データモデルフィールドは、自動抽出メソッドを使用して追加できます。次のステートメントのうち、自動抽出フィールドについて説明しているのはどれですか？ （該当するものをすべて選択）
- A. 自動抽出フィールドは、制約付きのデータセットにすでに存在する場合に追加できます。
- B. 自動抽出されたフィールドのデータ型を変更できます。
- C. 自動抽出されたフィールドには、ピボットで使用するためのわかりやすい名前を付けることができます。
- D. 自動抽出されたフィールドはピボットで非表示にできます。
正解：A、B、C、D
解説：
Data model fields are fields that describe the attributes of a dataset in a data model2. Data model fields can be
added using various methods such as Auto-Extracted, Evaluated or Lookup2. Auto-Extracted fields are fields
that are automatically extracted from your raw data using various techniques such as regular expressions,
delimiters or key-value pairs2. Auto-Extracted fields can be hidden in Pivot, which means that you can choose
whether to display them or not in the Pivot interface2. Therefore, option A is correct. Auto-Extracted fields
can have their data type changed, which means that you can specify whether they are strings, numbers,
booleans or timestamps2. Therefore, option B is correct. Auto-Extracted fields can be given a friendly name
for use in Pivot, which means that you can assign an alternative name to them that is more descriptive or
user-friendly than the original field name2. Therefore, option C is correct. Auto-Extracted fields can be added
if they already exist in the dataset with constraints, which means that you can include them in your data model
even if they are already extracted from your raw data by applying filters or constraints to limit the scope of
your dataset2. Therefore, option D is correct.
質問 # 43
タグに関する次の説明のうち、正しいものはどれですか。 （該当するものをすべて選択。）
- A. タグは、データをより理解しやすくするために設計されています。
- B. タグは検索に基づいてイベントを分類します。
- C. タグは大文字と小文字を区別しません。
- D. タグはフィールド/値のペアに基づいています。
正解：A、D
解説：
The following statements about tags are true: tags are based on field/value pairs and tags categorize events based on a search. Tags are custom labels that can be applied to fields or field values to provide additional context or meaning for your data. Tags can be used to filter or analyze your data based on common concepts or themes. Tags can be created by using various methods, such as search commands, configuration files, user interfaces, etc. Some of the characteristics of tags are:
* Tags are based on field/value pairs: This means that tags are associated with a specific field name and a specific field value. For example, you can create a tag called "alert" for the field name "status" and the field value "critical". This means that only events that have status=critical will have the "alert" tag applied to them.
* Tags categorize events based on a search: This means that tags are defined by a search string that matches the events that you want to tag. For example, you can create a tag called "web" for the search string sourcetype=access_combined. This means that only events that match the search string sourcetype=access_combined will have the "web" tag applied to them.
The following statements about tags are false: tags are case-insensitive and tags are designed to make data more understandable. Tags are case-sensitive and tags are designed to make data more searchable. Tags are case-sensitive: This means that tags must match the exact case of the field name and field value that they are associated with. For example, if you create a tag called "alert" for the field name "status" and the field value
"critical", it will not apply to events that have status=CRITICAL or Status=critical. Tags are designed to make data more searchable: This means that tags can help you find relevant events or patterns in your data by using common concepts or themes. For example, if you create a tag called "web" for the search string sourcetype=access_combined, you can use tag=web to find all events related to web activity.
質問 # 44
マクロ定義の引数を表すためにどの構文が使用されますか?
- A. %引数%
- B. '引数'
- C. $引数$
- D. 「引数」
正解：C
解説：
Explanation
The correct answer is D.
A search macro is a way to reuse a piece of SPL code in different searches. A search macro can take arguments, which are variables that can be replaced by different values when the macro is called. A search macro can also contain another search macro within it, which is called a nested macro1.
To represent an argument in a macro definition, you need to use the dollar sign ($) character to enclose the argument name. For example, if you want to create a search macro that takes one argument named "object", you can use the following syntax:
[my_macro(object)] search sourcetype= object
This will create a search macro named my_macro that takes one argument named object. When you call the macro in a search, you need to provide a value for the object argument, such as:
my_macro(web)
This will replace the object argument with the value web and run the following SPL code:
search sourcetype=web
The other options are not correct because they use quotation marks (' or ") or percentage signs (%) to represent arguments, which are not valid syntax for macro arguments. These characters will be interpreted as literal values instead of variables.
References:
Use search macros in searches
質問 # 45
Splunk Common Information Model (CIM) アドオンに付属するデータ モデルの説明はどこに記載されていますか?
- A. Pivot ユーザー マニュアル。
- B. データモデル コマンド リファレンス ガイド。
- C. CIM アドオンのマニュアル。
- D. ユーザー マニュアルの検索とレポート。
正解：C
質問 # 46
Splunk Common Information Model（CIM）がデータを正規化するために使用するナレッジオブジェクトはどれですか。フィールドエイリアス、イベントタイプ、およびタグに加えて？
- A. ルックアップ
- B. フィールド抽出
- C. マクロ
- D. ワークフローアクション
正解：A
解説：
Normalize your data for each of these fields using a combination of field aliases, field extractions, and
lookups.
https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
質問 # 47
次のアクションのうち、evalコマンドで実行できるのはどれですか？
- A. 1つ以上のフィールドでトランザクションをグループ化します。
- B. 既存のフィールドを作成または置換します。
- C. 他の検索で再利用するためにSPLコマンドを保存します。
- D. 結果からフィールドを削除します。
正解：B
質問 # 48
検索ワークフローアクションを作成する場合、どのフィールドが必要ですか？
- A. 検索文字列
- B. 権限設定
- C. データモデル名
- D. 評価ステートメント
正解：A
解説：
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Setupasearchworkflowaction
質問 # 49
検索ウィンドウからイベント タイプはどのように作成されますか? （該当するものをすべて選択）
- A. eventtypes.conf を編集し、新しいスタンザを追加します。
- B. 右上隅で、[名前を付けて保存] > [イベント タイプ] をクリックします。
- C. 追加 | SPL にイベントタイプを指定して検索を実行します。
- D. イベントの詳細ドロップダウンで、[イベント アクション] > [イベント タイプの構築] をクリックします。
正解：A、B
解説：
In Splunk, you can create an event type from the search window by running a search that would make a good event type, then clicking Save As and selecting Event Type1. This opens the Save as Event Type dialog, where you can provide the event type name and optionally apply tags to it1.
You can also create an event type by editing the eventtypes.conf file and adding a new stanza1. Each stanza in the eventtypes.conf file represents an event type1. The stanza name is the name of the event type, and the search attribute specifies the search string that defines the event type1.
It's important to note that while you can use the eventtype command in a search to find events associated with a specific event type, adding | eventtype to the SPL and executing the search does not create a new event type1. Similarly, clicking Event Actions > Build Event Type in an event's detail dropdown does not create a new event type1.
質問 # 50
二次検索を実行するワークフロー アクション タイプはどれですか?
- A. ドリルダウン
- B. 検索
- C. ポスト
- D. 取得
正解：B
解説：
The correct answer is D. Search.
A workflow action is a knowledge object that enables a variety of interactions between fields in events and other web resources. Workflow actions can create HTML links, generate HTTP POST requests, or launch secondary searches based on field values1.
There are three types of workflow actions that can be set up using Splunk Web: GET, POST, and Search2.
GET workflow actions create typical HTML links to do things like perform Google searches on specific values or run domain name queries against external WHOIS databases2.
POST workflow actions generate an HTTP POST request to a specified URI. This action type enables you to do things like creating entries in external issue management systems using a set of relevant field values2.
Search workflow actions launch secondary searches that use specific field values from an event, such as a search that looks for the occurrence of specific combinations of ipaddress and http_status field values in your index over a specific time range2.
Therefore, the workflow action type that performs a secondary search is Search.
Reference:
Splexicon:Workflowaction
About workflow actions in Splunk Web
質問 # 51
マクロ Weekly_sales (2) には、次の検索文字列が含まれています。
インデックス=ゲーム | eval ProductSales = $Price$ * $AmountSold$
結果を返すのは次のうちどれですか?
- A. '週間売上 (3.99, 10)'
- B. '週間売上 (3)'
- C. 'weekly_sales($3.995, $108)'
- D. 'weekly_sales (3.99, 10)'
正解：D
解説：
To use a search macro in a search string, you need to place a back tick character (`) before and after the macro
name1. You also need to use the same number of arguments as defined in the macro2. The macro weekly sales
(2) has two arguments:PriceandAmountSold. Therefore, you need to provide two values for these arguments
when you call the macro.
The option A is incorrect because it uses parentheses instead of back ticks around the macro name. The option
B is incorrect because it uses underscores instead of spaces in the macro name. The option D is incorrect
because it uses spaces instead of commas to separate the argument values.
Reference:1Use search macros in searches - Splunk Documentation2Define search macros in Settings - Splunk
Documentation
質問 # 52
次のステートメントのうち、フィールドエイリアスについて説明しているのはどれですか？
- A. フィールドエイリアス名が元のフィールド名を置き換えます。
- B. フィールドエイリアスは、ソースとソースタイプ間でのみデータを正規化します。
- C. フィールドエイリアスはルックアップファイル定義で使用できます。
- D. 検索の一部として使用する場合、フィールドエイリアス名では大文字と小文字が区別されません。
正解：C
解説：
Field aliases are alternative names for fields in Splunk. Field aliases can be used to normalize data across
different sources and sourcetypes that have different field names for the same concept. For example, you can
create a field alias for src_ip that maps to clientip, source_address, or any other field name that represents the
source IP address in different sourcetypes. Field aliases can also be used in lookup file definitions to map
fields in your data to fields in the lookup file. For example, you can use a field alias for src_ip to map it to
ip_address in a lookup file that contains geolocation information for IP addresses. Field alias names do not
replace the original field name, but rather create a copy of the field with a different name. Field alias names
are case sensitive when used as part of a search, meaning that src_ip and SRC_IP are different fields.
質問 # 53
次のevalコマンド関数のどれが有効ですか？
- A. カウント（）
- B. Int（）
- C. Tostring（）
- D. 印刷（）
正解：C
解説：
The eval command supports a number of functions that you can use in your expressions to
performcalculations, conversions, string manipulations and more2. One of the eval command functions is
tostring(), which converts a numeric value to a string value2. Therefore, option D is correct, while options A,
B and C are incorrect because they are not valid eval command functions.
質問 # 54
......
究極のSPLK-1002日本語無料準備ガイド最新のSplunk練習テスト問題集：https://jp.fast2test.com/SPLK-1002J-premium-file.html