SPLK-1004
Free trial
Verified
Question 1
Which statement about tsidx files is accurate?
- A: Splunk updates tsidx files every 30 minutes.
- B: Splunk removes outdated tsidx files every 5 minutes.
- C: A tsidx file consists of a lexicon and a posting list.
- D: Each bucket in each index may contain only one tsidx file.
Question 2
What is an example of the simple XML syntax for a base search and its post-process search?
- A: <search id="myBaseSearch">, <search base="myBaseSearch">
- B: <search globalsearch="myBaseSearch">, <search globalsearch>
- C: <panel id="myBaseSearch">, <panel base="myBaseSearch">
- D: <search id="myGlobalSearch">, <search base="myBaseSearch">
Question 3
What qualifies a report for acceleration?
- A: Fewer than 100k events in search results, with transforming commands used in the search string.
- B: More than 100k events in search results, with only a search command in the search string.
- C: More than 100k events in the search results, with a search and transforming command used in the search string.
- D: Fewer than 100k events in search results, with only a search and transaction command used in the search string.
Question 4
What happens to panels with post-processing searches when their base search is refreshed?
- A: The panels are deleted.
- B: The panels are only refreshed if they have also been configured.
- C: The panels are refreshed automatically.
- D: Nothing happens to the panels.
Question 5
How is a cascading input used?
- A: As part of a dashboard, but not in a form.
- B: Without token notation in the underlying XML.
- C: As a way to filter other input selections.
- D: As a default way to delete a user role.
Question 6
Which commands can run on both search heads and indexers?
- A: Transforming commands
- B: Centralized streaming commands
- C: Dataset processing commands
- D: Distributable streaming commands
Question 7
If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?
- A: Double tick marks around the nested macro.
- B: A comma before the nested macro.
- C: Square brackets around the nested macro.
- D: A pipe character before the nested macro.
Question 8
When using a nested search macro, how can an argument value be passed to the inner macro?
- A: The argument value may be passed to the outer macro.
- B: An argument cannot be used with an inner nested macro.
- C: An argument cannot be used with an outer nested macro.
- D: The argument value must be specified in the outer macro.
Question 9
Which is a regex best practice?
- A: Use complex expressions rather than simple ones.
- B: Avoid backtracking.
- C: Use greedy operators (.*) instead of non-greedy operators (.*?).
- D: Use * rather than +.
Question 10
What does the query | makeresults generate?
- A: A timestamp
- B: A results field
- C: An error message
- D: The results of the previously run search
Question 11
Why use the tstats command?
- A: As an alternative to the summary command.
- B: To generate statistics on indexed fields.
- C: To generate an accelerated datamodel.
- D: To generate statistics on search-time fields.
Question 12
Repeating JSON data structures within one event will be extracted as what type of fields?
- A: Single value
- B: Lexicographical
- C: Multivalue
- D: Mvindex
Question 13
Which of the following can be used to access external lookups?
- A: Perl and Python
- B: Python and Ruby
- C: Perl and binary executable
- D: Python and binary executable
That’s the end of your free questions
You’ve reached the preview limit for SPLK-1004Consider upgrading to gain full access!
Free preview mode
Enjoy the free questions and consider upgrading to gain full access!