SPLUNK CORE CERTIFIED POWER USER
What is the only writeable bucket type?
ANSWER – The hot bucket
By what filter are indexes divided into buckets?
ANSWER – By time
What are the 4 types of searches in Splunk (by performance)
ANSWER – Dense, Sparse, Super Sparse, Rare
In searches, what is the scanCount?
ANSWER – The number of events scanned for that particular search
What are the requirement of the underlying search in order to get multi-series table?
ANSWER – The underlying search must use reporting search commands like chart or timechart
What are the seven chart types?
ANSWER – Line, Area, Column, Bar, Bubble, Scatter and Pie
ESTUDY
What is a trait of scatter charts?
ANSWER – Can only show two dimensions. Shows trends in the relationsgip between discrete data
values
What is a trait of bubble charts?
ANSWER – Provides a visual way to view a three dimensional series
What are two commonly used clauses for chart?
ANSWER – over and by
What does the over and by clauses do when used with chart?
ANSWER – divides the data into sub-groupings
(True/False) You can only split chart results over two dimensions
ANSWER – True
chart and timechart commands automatically filter results to include how many values?
ANSWER – 10
ESTUDY
What happens to surplus resulting values of chart and timechart commands?
ANSWER – They are grouped into other
(True/False) Null values are not shown by default by chart and timechart
ANSWER – False
What is always the value on the x-axis for timechart?
ANSWER – _time
(True/False) Functions and arguments used with stats and chart can not be used with timechart
ANSWER – False
(True/False) As with chart, it is possible to split timechart by two fields
ANSWER – False. It is only possible to split by one field
What is the argument for adjusting sampling interval of timechart?
ANSWER – span
What does the trendline command do?
Get the full exam pdf here https://learnexams.com/
For reference https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-power-user.html