Describe the Splunk CIM SPLK-1002 Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   An organization has a custom application that generates security events. The events contain a field 'event_type' with values like 'login_success' and 'login_failure'. The admin wants these events to appear in the CIM Authentication data model. What must the admin do to make this happen?

   • ARename the 'event_type' field to 'action' and set the sourcetype to 'authentication'.
   • BUse the 'eval' command in every search to convert 'event_type' to 'action'.
   • CCreate a new data model named 'CustomAuthentication' and add the events to it.
   • DAdd a tag 'authentication' to the sourcetype in props.conf and ensure the 'action' field is extracted.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An admin is troubleshooting why a search against the Endpoint data model returns no results, even though endpoint logs are clearly being indexed. The logs contain fields like 'process_name' and 'dest_host'. What is the most likely reason the data model search returns nothing?

   • AThe logs are not being tagged with the 'endpoint' tag, so they are not mapped to the Endpoint data model.
   • BThe Endpoint data model requires a specific index named 'endpoint' to be created before it can be searched.
   • CThe 'process_name' field is not a valid CIM field, so the data model rejects the events.
   • DThe data model must be accelerated before any search can return results, regardless of tags.
   Reveal Solution Discussion Select an answer first