SPLK-1002 practice questions 1–10

1. Question 1 · 226 in bank

   Which one of the following statements about the search command is true?

   • AIt does not allow the use of wildcards.
   • BIt treats field values in a case-sensitive manner.
   • CIt can only be used at the beginning of the search pipeline.
   • DIt behaves exactly like search strings before the first pipe.

   Show answer

   Answer: D

   Next question

2. Question 2 · 226 in bank

   Which of the following actions can the eval command perform?

   • ARemove fields from results.
   • BCreate or replace an existing field.
   • CGroup transactions by one or more fields.
   • DSave SPL commands to be reused in other searches.

   Show answer

   Answer: B

   Next question

3. Question 3 · 226 in bank

   When can a pipe follow a macro?

   • AA pipe may always follow a macro.
   • BThe current user must own the macro.
   • CThe macro must be defined in the current app.
   • DOnly when sharing is set to global for the macro.

   Show answer

   Answer: A

   Next question

4. Question 4 · 226 in bank

   Select 3

   Data models are composed of one or more of which of the following datasets? (Choose all that apply.)

   • AEvents datasets
   • BSearch datasets
   • CTransaction datasets
   • DAny child of event, transaction, and search datasets

   Show answer

   Answer: ABC

   Next question

5. Question 5 · 226 in bank

   Select 2

   When using the Field Extractor (FX), which of the following delimiters will work? (Choose all that apply.)

   • ATabs
   • BPipes
   • CColons
   • DSpaces

   Show answer

   Answer: AB

   Next question

6. Question 6 · 226 in bank

   Which group of users would most likely use pivots?

   • AUsers
   • BArchitects
   • CAdministrators
   • DKnowledge Managers

   Show answer

   Answer: A

   Next question

7. Question 7 · 226 in bank

   When multiple event types with different color values are assigned to the same event, what determines the color displayed for the event?

   • ARank
   • BWeight
   • CPriority
   • DPrecedence

   Show answer

   Answer: C

   Next question

8. Question 8 · 226 in bank

   Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

   

   • A"convert_sales(euro,ג‚¬,.79)"
   • B'convert_sales(euro,ג‚¬,.79)'
   • C"convert_sales($euro$,$ג‚¬$,$.79$)"
   • D'convert_sales($euro$,$ג‚¬$,$.79$)'

   Show answer

   Answer: B

   Next question

9. Question 9 · 226 in bank

   There are several ways to access the field extractor. Which option automatically identifies the data type, source type, and sample event?

   • AEvent Actions > Extract Fields
   • BFields sidebar > Extract New Fields
   • CSettings > Field Extractions > New Field Extraction
   • DSettings > Field Extractions > Open Field Extractor

   Show answer

   Answer: A

   Next question

10. Question 10 · 226 in bank

    Which of the following statements would help a user choose between the transaction and stats commands?

    • Astats can only group events using IP addresses.
    • BThe transaction command is faster and more efficient.
    • CThere is a 1000 event limitation with the transaction command.
    • DUse stats when the events need to be viewed as a single correlated event.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 1. 226 questions available.