Pass Using SPLK-1002 Exam Dumps

Splunk Core Certified Power User Exam Questions and Answers

Question 5

Given the following eval statement:

... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2)

Which of the following is the equivalent using fillnull?

... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)

There is no equivalent expression using fillnull

... | fillnull field1 | fillnull value="NO-VALUE" field2

... | fillnull value=0 field1 | fillnull field2

Question 6

In which Settings section are macros defined?

Fields

Tokens

Advanced Search

Searches, Reports, Alerts

Question 7

Which command can include both an over and a by clause to divide results into sub-groupings?

chart

stats

xyseries

transaction

Question 8

Which of the following is NOT a stats function:

sum

addtotals

count

avg