When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Only events with the required string will be included in the extraction.

The regex can no longer be edited.

The field being extracted will be required for all future events.

The events without the required field will not display in searches.

Only events with the required string will be included in the extraction.

When using timechart, how many fields can be listed after a by clause?

because _time is already implied as the x-axis.

because timechart doesn't support using a by clause.

because _time is already implied as the x-axis.

because one field would represent the x-axis and the other would represent the y-axis.

There is no limit specific to timechart.

What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

CIM does not work with different names for the same field.

When should you use the transaction command instead of the scats command?

When you need to group based on start and end constraints.

When you need to group on multiple values.

When duration is irrelevant in search results. .

When you have over 1000 events in a transaction.

When you need to group based on start and end constraints.

Which of the following statements describes field aliases?

Field aliases can be used in lookup file definitions.

Field alias names replace the original field name.

Field aliases can be used in lookup file definitions.

Field aliases only normalize data across sources and sourcetypes.

Field alias names are not case sensitive when used as part of a search.

The eval command 'if' function requires the following three arguments (in order):

Boolean expression, result if true, result if false

Result if true, result if false, boolean expression

Result if false, result if true, boolean expression

Boolean expression, result if false, result if true

For choropleth maps,splunk ships with the following KMZ files (select all that apply)

States and provinces of the united states and Canada

Countries of the European Union

What does the following search do?

Creates a table of the total count of mysterymeat corndogs split by user.

Creates a table of the total count of users and split by corndogs.

Creates a table of the total count of mysterymeat corndogs split by user.

Creates a table with the count of all types of corndogs eaten split by user.

Creates a table that groups the total number of users by vegetarian corndogs.

Which of the following statements describes Search workflow actions?

The user can define the time range of the search when created the workflow action.

By default. Search workflow actions will run as a real-time search.

Search workflow actions can be configured as scheduled searches,

The user can define the time range of the search when created the workflow action.

Search workflow actions cannot be configured with a search string that includes the transaction command

What do events in a transaction have In common?

All events in a transaction must be related by one or more fields.

All events In a transaction must have the same timestamp.

All events in a transaction must have the same sourcetype.

All events in a transaction must have the exact same set of fields.

All events in a transaction must be related by one or more fields.

Which of the following statements describe GET workflow actions?

GET workflow actions can be configured to open the URT link in the current window or in a new window

GET workflow actions must be configured with POST arguments.

Configuration of GET workflow actions includes choosing a sourcetype.

Label names for GET workflow actions must include a field name surrounded by dollar signs.

GET workflow actions can be configured to open the URT link in the current window or in a new window

Data model are composed of one or more of which of the following datasets? (select all that apply.)

Any child of event, transaction, and search datasets

Which are valid ways to create an event type? (select all that apply)

By going to the Settings menu and clicking Event Types > New.

By selecting an event in search results and clicking Event Actions > Build Event Type.

By using the searchtypes command in the search bar.

By editing the event_type stanza in the props.conf file.

By going to the Settings menu and clicking Event Types > New.

By selecting an event in search results and clicking Event Actions > Build Event Type.

Which of the following statements describe the search string below?| datamodel Application_State All_Application_State search

Events will be returned from the data model named Application_State.

Evenrches would return a report of sales bystate.

Events will be returned from the data model named Application_State.

Events will be returned from the data model named All_Application_state.

No events will be returned because the pipe should occur after the datamodel command

What is the relationship between data models and pivots?

Data models provide the datasets for pivots.

Pivots and data models have no relationship.

Pivots and data models are the same thing.

Pivots provide the datasets for data models.

In which of the following scenarios is an event type more effective than a saved search?

When the search string needs to be used in future searches.

When a search should always include the same time range.

When a search needs to be added to other users' dashboards.

When the search string needs to be used in future searches.

When formatting needs to be included with the search string.

How does a user display a chart in stack mode?

By changing Stack Mode in the Format menu.

By turning on the Use Trellis Layout option.

By changing Stack Mode in the Format menu.

You cannot display a chart in stack mode, only a timechart.

Which of the following statements about event types is true? (select all that apply)

Event types categorize events based on a search.

Event types can be a useful method for capturing and sharing knowledge.

Event types must include a time range,

Event types categorize events based on a search.

Event types can be a useful method for capturing and sharing knowledge.

In what order arc the following knowledge objects/configurations applied?

Field Extractions, Field Aliases, Lookups

Field Aliases, Field Extractions, Lookups

Field Extractions, Field Aliases, Lookups

Field Extractions, Lookups, Field Aliases

Lookups, Field Aliases, Field Extractions

A calculated field maybe based on which of the following?

Fields generated within a search string

Which of the following Statements about macros is true? (select all that apply)

Arguments are defined when the macro is created.

Argument values are used to resolve the search string at execution time.

Arguments are defined at execution time.

Arguments are defined when the macro is created.

Argument values are used to resolve the search string at execution time.

Argument values are used to resolve the search string when the macro is created.

What is required for a macro to accept three arguments?

The macro's name ends with (3).

The macro's name starts with (3).

The macro's argument count setting is 3 or more.

Nothing, all macros can accept any number of arguments.

Which of the following statements describes POST workflow actions?

POST workflow actions can open a web page in either the same window or a new .

POST workflow actions are always encrypted.

POST workflow actions cannot use field values in their URI.

POST workflow actions cannot be created on custom sourcetypes.

POST workflow actions can open a web page in either the same window or a new .

Which of the following searches show a valid use of macro? (Select all that apply)

index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField

index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

index=main source=mySource oldField=* | ''newField('makeMyField(oldField)')'' | table _time newField

Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

| datamodel web search | filed web *

| Search datamodel web web | filed web*

| datamodel web web field | search web*

Datamodel=web | search web | filed web*

Splunk SPLK-1002 Practice Test 1 - Free Online Exam Questions 1-40

Question 1 / 40

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Both will appear in the All Fields list, but only if the alias is specified in the search.

Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Comment (0)

Splunk SPLK-1002 Practice Test 1

Question

Splunk SPLK-1002 Practice Tests

Practice Tests