SPLK-1002 practice questions 131–140

1. Question 131 · 226 in bank

   Which field will be used to populate the productINFO field if the productName and productId fields have values for a given event? | eval productINFO=coalesce(productName, productId)

   • AThe value for the productName field because it appears first.
   • BNeither field value will be used and the productINFO field will be assigned a NULL value for the given event.
   • CThe value for the productID field because it appears second.
   • DBoth field values will be used and the productINFO field will become a multivalue field for the given event.

   Show answer

   Answer: A

   Next question

2. Question 132 · 226 in bank

   Which method in the Field Extractor would extract the port number from the following event? 10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin

   • ADelimiter
   • BThe Field Extractor tool cannot extract regular expressions.
   • CRegular expression
   • Drex command

   Show answer

   Answer: C

   Next question

3. Question 133 · 226 in bank

   Which of the following commands connects an additional table of data directly to the right side of the existing table?

   • Asubsearch
   • Bappendcols
   • Cappend
   • Dupdate

   Show answer

   Answer: B

   Next question

4. Question 134 · 226 in bank

   Which of the following is a feature of the Pivot tool?

   • AData Models are not required.
   • BCreates reports without using SPL.
   • CCreates lookups without using SPL.
   • DDatasets are not required.

   Show answer

   Answer: B

   Next question

5. Question 135 · 226 in bank

   Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

   • AGET
   • BSearch
   • CFormat
   • DPOST

   Show answer

   Answer: D

   Next question

6. Question 136 · 226 in bank

   Which of the following is included with the Common Information Model (CIM) add-on?

   • Atsidx files
   • BSearch macros
   • CWorkflow actions
   • DEvent category tags

   Show answer

   Answer: D

   Next question

7. Question 137 · 226 in bank

   Which of the following searches will return all clientip addresses that start with 108?

   • A... | where (clientip, "108.%"
   • B... | where like(clientip, "108.%")
   • C... | where (clientip=108.%)
   • D... | search clientip=108

   Show answer

   Answer: B

   Next question

8. Question 138 · 226 in bank

   Which of the following knowledge objects can reference field aliases?

   • ACalculated fields and event types only.
   • BCalculated fields and tags only.
   • CCalculated fields, lookups, event types, and tags.
   • DCalculated fields, lookups, event types, and extracted fields.

   Show answer

   Answer: C

   Next question

9. Question 139 · 226 in bank

   If a calculated field has the same name as an extracted field, what happens to the extracted field?

   • AThe calculated field will override the extracted field.
   • BThe calculated and extracted fields will be combined.
   • CThe calculated field will duplicate the extracted field.
   • DAn error will be returned and the search will fail.

   Show answer

   Answer: A

   Next question

10. Question 140 · 226 in bank

    Which field extraction method should be selected for comma-separated data?

    • Atable extraction
    • Beval expression
    • CRegular expression
    • DDelimiters

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 131. 226 questions available.