BBy enclosing the macro name in single-quote characters (').
CBy using the macro command.
DBy enclosing the macro name in backtick characters (').
Which of the following actions can the eval command perform?
ARemove fields from results.
BCreate or replace an existing field.
CGroup transactions by one or more fields.
DSave SPL commands to be reused in other searches.
Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)
ACIM is a methodology for normalizing data.
BCIM can correlate data from different sources.
CThe Knowledge Manager uses the CIM to create knowledge objects.
DCIM is an app that can coexist with other apps on a single Splunk deployment.
Which one of the following statements about the search command is true?
AIt does not allow the use of wildcards.
BIt treats field values in a case-sensitive manner.
CIt can only be used at the beginning of the search pipeline.
DIt behaves exactly like search strings before the first pipe.
By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?
ATurned off.
BTurned on.
CDetermined automatically based on the sourcetype.
DDetermined automatically based on the data source.
What do events in a transaction have in common?
AAll events in a transaction must have the same timestamp.
BAll events in a transaction must have the same sourcetype.
CAll events in a transaction must have the exact same set of fields.
DAll events in a transaction must be related by one or more fields.
Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)
ATabs
BPipes
CSpaces
DCommas
Which of the following statements describe calculated fields? (Choose all that apply.)
ACalculated fields can be used in the search bar.
BCalculated fields can be based on an extracted field.
CCalculated fields can only be applied to host and sourcetype.
DCalculated fields are shortcuts for performing calculations using the eval command.
When should transaction be used?
AOnly in a large distributed Splunk environment.
BWhen calculating results from one or more fields.
CWhen event grouping is based on start/end values.
DWhen grouping events results in over 1000 events in each group.
When using | timechart by host, which field is represented in the x-axis?
Adate
Bhost
Ctime
D_time
What is required for a macro to accept three arguments?
AThe macro's name ends with (3).
BThe macro's name starts with (3).
CThe macro's argument count setting is 3 or more.
DNothing, all macros can accept any number of arguments.
Which workflow action method can be used when the action type is set to link?
AGET
BPUT
CSearch
DUPDATE
Which of the following statements about macros is true? (Choose all that apply.)
AArguments are defined at execution time.
BArguments are defined when the macro is created.
CArgument values are used to resolve the search string at execution time.
DArgument values are used to resolve the search string when the macro is created.
Information needed to create a GET workflow action includes which of the following? (Choose all that apply.)
AA name for the workflow action.
BA URI where the user will be directed at search time.
CA label that will appear in the Event Action menu at search time.
DA name for the URI where the user will be directed at search time.
Which of the following statements describe data model acceleration? (Choose all that apply.)
ARoot events cannot be accelerated.
BAccelerated data models cannot be edited.
CPrivate data models cannot be accelerated.
DYou must have administrative permissions or the accelerate_datamodel capability to accelerate a data model.
How does a user display a chart in stack mode?
ABy using the stack command.
BBy turning on the Use Trellis Layout option.
CBy changing Stack Mode in the Format menu.
DYou cannot display a chart in stack mode, only a timechart.
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
A| chart count by vendor_action, user
B| chart count over vendor_action, user
C| chart count by vendor_action over user
D| chart count over user by vendor_action
A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.
Which field name appears in the results?
ABoth will appear in the All Fields list, but only if the alias is specified in the search.
BBoth will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
CThe original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
DThe alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.
In which of the following scenarios is an event type more effective than a saved search?
AWhen a search should always include the same time range.
BWhen a search needs to be added to other users' dashboards.
CWhen the search string needs to be used in future searches.
DWhen formatting needs to be included with the search string.
Which of the following statements about event types is true? (Choose all that apply.)
AEvent types can be tagged.
BEvent types must include a time range.
CEvent types categorize events based on a search.
DEvent types can be a useful method for capturing and sharing knowledge.
Which of the following statements describes the use of the Field Extractor (FX)?
AThe Field Extractor automatically extracts all fields at search time.
BThe Field Extractor uses PERL to extract fields from the raw events.
CFields extracted using the Field Extractor persist as knowledge objects.
DFields extracted using the Field Extractor do not persist and must be defined for each search.
A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?
AIt doesn't matter whether eval or sort is used first.
BConvert the numeric to a string with eval first, then sort.
CUse sort first, then convert the numeric to a string with eval.
DYou cannot use the sort command and the eval command on the same field.
In what order are the following knowledge objects/configurations applied?
AField Aliases, Field Extractions, Lookups
BField Extractions, Field Aliases, Lookups
CField Extractions, Lookups, Field Aliases
DLookups, Field Aliases, Field Extractions
Which of the following statements describes field aliases?
AField alias names replace the original field name.
BField aliases can be used in lookup file definitions.
CField aliases only normalize data across sources and sourcetypes.
DField alias names are not case sensitive when used as part of a search.
Which of the following is the correct way to use the datamodel command to search fields in the Web data model within the Web dataset?
Preview
