SPLK-1002日本語問題集最新版を今すぐ試そう！[2024年04月] 試験準備には欠かせません！
有能な受験者がシミュレーション済みのSPLK-1002日本語試験PDF問題を試そう
質問 # 12
二次検索を実行するワークフロー アクション タイプはどれですか?
- A. 取得
- B. ドリルダウン
- C. ポスト
- D. 検索
正解：D
解説：
Explanation
The correct answer is D. Search.
A workflow action is a knowledge object that enables a variety of interactions between fields in events and other web resources. Workflow actions can create HTML links, generate HTTP POST requests, or launch secondary searches based on field values1.
There are three types of workflow actions that can be set up using Splunk Web: GET, POST, and Search2.
GET workflow actions create typical HTML links to do things like perform Google searches on specific values or run domain name queries against external WHOIS databases2.
POST workflow actions generate an HTTP POST request to a specified URI. This action type enables you to do things like creating entries in external issue management systems using a set of relevant field values2.
Search workflow actions launch secondary searches that use specific field values from an event, such as a search that looks for the occurrence of specific combinations of ipaddress and http_status field values in your index over a specific time range2.
Therefore, the workflow action type that performs a secondary search is Search.
References:
Splexicon:Workflowaction
About workflow actions in Splunk Web
質問 # 13
|を使用する場合 ホスト別の timchart、どのフィールドが X 軸に表されますか?
- A. 日付
- B. 時間
- C. ホスト
- D. -時間
正解：A
質問 # 14
次の検索で 1 つではなく複数のトランザクションが生成されるのはなぜですか?
maxspan オプションは含まれていません。
トランザクション コマンドには、トランザクションごとに 1000 イベントの制限があります。
トランザクションとコマンドを併用することはできません。
stats list() 関数が使用されます。
正解：
解説：
The maxspan option is not included1.
In Splunk, the transaction command is used to group events that share common characteristics into a single transaction1. By default, the transaction command groups all matching events into a single transaction1.
However, you can use the maxspan option to limit the time span of the transactions1. If the time span between the first and last event in a transaction exceeds the maxspan value, the transaction command will start a new transaction1.
Therefore, if the maxspan option is not included in the search, the transaction command might produce multiple transactions instead of one if the time span between the first and last event in a transaction exceeds the default maxspan value1.
Here is an example of how you can use the maxspan option in a search:
index=main sourcetype=access_combined | transaction someuniqefield maxspan=1h In this search, the transaction command groups events that share the same someuniqefield value into a single transaction, but only if the time span between the first and last event in the transaction does not exceed 1 hour1. If the time span exceeds 1 hour, the transaction command will start a new transaction1.
Explanation:
The correct answer is
質問 # 15
次のステートメントのうち、POSTワークフローアクションを説明しているのはどれですか？
- A. POSTワークフローアクションは、URIでフィールド値を使用できません。
- B. POSTワークフローアクションは常に暗号化されます。
- C. POSTワークフローアクションはカスタムソースタイプでは作成できません。
- D. POSTワークフローアクションは、同じウィンドウまたは新しいウィンドウでWebページを開くことができます。
正解：D
解説：
A workflow action is a link that appears when you click an event field value in your search results1. A workflow action can open a web page or run another search based on the field value1. There are two types of workflow actions: GET and POST1. A GET workflow action appends the field value to the end of a URI and opens it in a web browser1. A POST workflow action sends the field value as part of an HTTP request to a web server1. You can configure a workflow action to open a web page in either the same window or a new window1. Therefore, option D is correct, while options A, B and C are incorrect.
質問 # 16
Field Extractorユーティリティにアクセスする方法はいくつありますか？
- A. 0
- B. 1
- C. 2
- D. 3
正解：D
質問 # 17
次のうち、チャートコマンドで有効なオプションはどれですか？（該当するものをすべて選択してください）
- A. split = t
- B. usenull = f
- C. useother = f
- D. transcation = t
正解：B、C
質問 # 18
次のステートメントのうち、計算フィールドについて説明しているのはどれですか？ （該当するものをすべて選択）
- A. 計算フィールドは、ホストとソースタイプにのみ適用できます。
- B. 計算フィールドは検索バーで使用できます。
- C. 計算されたフィールドは、抽出されたフィールドに基づくことができます。
- D. 計算フィールドは、evalコマンドを使用して計算を実行するためのショートカットです。
正解：B、C、D
解説：
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields
質問 # 19
リンクするように設定されているアクションタイプを使用できるワークフローアクションメソッドはどれですか？
- A. GET
- B. 検索
- C. PUT
- D. 更新
正解：A
解説：
Explanation
https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps Navigate to Settings > Fields > Workflow Actions.
Click New to open up a new workflow action form.
Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu.
Labels can be static or include the value of relevant fields.
Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
Set Action type to link.
In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
Set the Link method to get.
Click Save to save your workflow action definition.
質問 # 20
次の検索は何をしますか？
- A. 菜食主義のアメリカンドッグごとにユーザーの総数をグループ化するテーブルを作成します。
- B. 食べたすべての種類のアメリカンドッグの数をユーザーごとに分けて表を作成します。
- C. ユーザーごとに分割されたミステリーアメリカンドッグの総数のテーブルを作成します。
- D. ユーザーの総数とアメリカンドッグごとの分割のテーブルを作成します。
正解：C
解説：
The search string below creates a table of the total count of mysterymeat corndogs split by user.
| stats count by user | where corndog=mysterymeat
The search string does the following:
It uses the stats command to calculate the count of events for each value of the user field. The stats
command creates a table with two columns: user and count.
It uses the where command to filter the results by the value of the corndog field. The where command
only keeps the rows where corndog equals mysterymeat.
Therefore, the search string creates a table of the total count of mysterymeat corndogs split by user.
質問 # 21
データ内に値が " "、または空だが null ではないフィールドがある場合、値を追加するのは次のうちどれですか?
- A. | eval notNULL = if(isnull (notNULL), "0" notNULL)
- B. | eval notNULL = "" | nullfill value=0 notNULL
- C. | eval notNULL = if(isnull (notNULL), "0"
- D. | eval notNULL = "" fillnull value=0 notNULL
正解：D
解説：
The correct answer is D. | eval notNULL = "" fillnull value=0 notNULL
Option A is incorrect because it is missing a comma between the "0" and the notNULL in the if
function. The correct syntax for the if function is if (condition, true_value, false_value).
Option B is incorrect because it is missing the false_value argument in the if function. The correct
syntax for the if function is if (condition, true_value, false_value).
Option C is incorrect because it uses the nullfill command, which only replaces null values, not empty
strings. The nullfill command is equivalent to fillnull value=null.
Option D is correct because it uses the eval command to assign an empty string to the notNULL field,
and then uses the fillnull command to replace the empty string with a zero. The fillnull command can
replace any value with a specified replacement, not just null values.
質問 # 22
GETワークフローアクションを作成するために必要な情報には、次のうちどれが含まれますか？ （該当するものをすべて選択。）
- A. ユーザーが検索時に誘導されるURI。
- B. ワークフローアクションの名前
- C. 検索時にユーザーが誘導されるURIの名前。
- D. 検索時に[イベントアクション]メニューに表示されるラベル。
正解：A、B、D
解説：
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/SetupaGETworkflowaction Information needed to create a GET workflow action includes the following: a name of the workflow action, a URI where the user will be directed at search time, and a label that will appear in the Event Action menu at search time. A GET workflow action is a type of workflow action that performs a GET request when you click on a field value in your search results. A GET workflow action can be configured with various options, such as:
A name of the workflow action: This is a unique identifier for the workflow action that is used internally by Splunk. The name should be descriptive and meaningful for the purpose of the workflow action.
A
URI where the user will be directed at search time: This is the base URL of the external web service or application that will receive the GET request. The URI can include field value variables that will be replaced by the actual field values at search time. For example, if you have a field value variable ip, you can write it as
http://example.com/ip=$ip to send the IP address as a parameter to the external web service or application.
A label that will appear in the Event Action menu at search time: This is the display name of the workflow action that will be shown in the Event Action menu when you click on a field value in your search results. The label should be clear and concise for the user to understand what the workflow action does.
Therefore, options A, B, and C are correct.
質問 # 23
計算フィールドは、次のコマンドのどれを使用して、繰り返し、長い、または複雑な変換を実行するためのショートカットです。
- A. トランザクション
- B. 統計
- C. ルックアップ
- D. 評価
正解：D
解説：
Explanation
The correct answer is D. eval.
A calculated field is a field that is added to events at search time by using an eval expression. A calculated field can use the values of two or more fields that are already present in the events to perform calculations. A calculated field can be defined with Splunk Web or in the props.conf file. They can be used in searches, reports, dashboards, and data models like any other extracted field1.
A calculated field is a shortcut for performing repetitive, long, or complex transformations using the eval command. The eval command is used to create or modify fields by using expressions. The eval command can perform mathematical, string, date and time, comparison, logical, and other operations on fields or values2.
For example, if you want to create a new field named total that is the sum of two fields named price and tax, you can use the eval command as follows:
| eval total=price+tax
However, if you want to use this new field in multiple searches, reports, or dashboards, you can create a calculated field instead of writing the eval command every time. To create a calculated field with Splunk Web, you need to go to Settings > Fields > Calculated Fields and enter the name of the new field (total), the name of the sourcetype (sales), and the eval expression (price+tax). This will create a calculated field named total that will be added to all events with the sourcetype sales at search time. You can then use the total field like any other extracted field without writing the eval expression1.
The other options are not correct because they are not related to calculated fields. These options are:
A: transaction: This command is used to group events that share some common values into a single record, called a transaction. A transaction can span multiple events and multiple sources, and can be useful for correlating events that are related but not contiguous3.
B: lookup: This command is used to enrich events with additional fields from an external source, such as a CSV file or a database. A lookup can add fields to events based on the values of existing fields, such as host, source, sourcetype, or any other extracted field.
C: stats: This command is used to calculate summary statistics on the fields in the search results, such as count, sum, average, etc. It can be used to group and aggregate data by one or more fields.
References:
About calculated fields
eval command overview
transaction command overview
[lookup command overview]
[stats command overview]
質問 # 24
「アラート」タグを「ホスト」フィールドに制限する検索はどれですか？
- A. tag = alert
- B. tag == alert
- C. tag :: host = alert
- D. host :: tag :: alert
正解：C
解説：
Explanation
The search below would limit an "alert" tag to the "host" field.
tag::host=alert
The search does the following:
It uses tag syntax to filter events by tags. Tags are custom labels that can be applied to fields or field values to provide additional context or meaning for your data.
It specifies tag::host=alert as the tag filter. This means that it will only return events that have an "alert" tag applied to their host field or host field value.
It uses an equal sign (=) to indicate an exact match between the tag and the field or field value.
質問 # 25
マクロ定義の引数を表すためにどの構文が使用されますか?
- A. %引数%
- B. 「引数」
- C. $引数$
- D. '引数'
正解：C
解説：
Explanation
The correct answer is D.
A search macro is a way to reuse a piece of SPL code in different searches. A search macro can take arguments, which are variables that can be replaced by different values when the macro is called. A search macro can also contain another search macro within it, which is called a nested macro1.
To represent an argument in a macro definition, you need to use the dollar sign ($) character to enclose the argument name. For example, if you want to create a search macro that takes one argument named "object", you can use the following syntax:
[my_macro(object)] search sourcetype= object
This will create a search macro named my_macro that takes one argument named object. When you call the macro in a search, you need to provide a value for the object argument, such as:
my_macro(web)
This will replace the object argument with the value web and run the following SPL code:
search sourcetype=web
The other options are not correct because they use quotation marks (' or ") or percentage signs (%) to represent arguments, which are not valid syntax for macro arguments. These characters will be interpreted as literal values instead of variables.
References:
Use search macros in searches
質問 # 26
少なくとも1つのREJECTイベントを含むトランザクション内のすべての寄与イベントを識別するには、どの構文が正しいですか？
- A. インデックス-メイン|トランザクションセッションID |検索拒否
- B. インデックス-メイン|トランスセッションIDを拒否します
- C. インデックス=メイン|トランザクションセッションID |そのtransaction = reject
- D. インデックス=メイン|トランザクションセッションID |ここで、transaction = reject ''
正解：A
質問 # 27
ユーザーはスタックモードでチャートをどのように表示しますか？
- A. stackコマンドを使用します。
- B. スタックモードではチャートを表示できません。タイムチャートのみを表示できます。
- C. フォーマットメニューでスタックモードを変更します。
- D. [トレリスレイアウトを使用]オプションをオンにします。
正解：C
解説：
A chart is a graphical representation of your search results that shows the relationship between two or more
fields2. You can display a chart in stack mode by changing the Stack Mode option in the Format menu2. Stack
mode allows you to stack multiple series on top of each other in a chart to show the cumulative values of each
series2. Therefore, option C is correct, while options A, B and D are incorrect because they are not ways to
display a chart in stack mode.
質問 # 28
フィールドのサイドバーには________は表示されません。 （該当するものをすべて選択。）
- A. 興味深い分野
- B. 抽出されたすべてのフィールド
- C. 選択したフィールド
正解：B
解説：
The fields sidebar is a panel that shows the fields that are present in your search results2. The fields sidebar does not show all extracted fields, which are fields that are extracted from your raw data using various methods such as regular expressions, delimiters or key-value pairs2. The fields sidebar only shows selected fields and interesting fields2. Selected fields are fields that you choose to display in your search results by clicking on them in the fields sidebar or by using the fields command2. Interesting fields are fields that appear in at least 20 percent of events or have high variability among values2. Therefore, option C is correct, while options A and B are incorrect because they are types of fields that the fields sidebar does show.
質問 # 29
......
検証済み材料を使うならまずSPLK-1002日本語テストエンジンを試そう：https://jp.fast2test.com/SPLK-1002J-premium-file.html