SPLK-1002 practice questions 161–170

1. Question 161 · 226 in bank

   Why would the following search produce multiple transactions instead of one?

   

   

   • AThe maxspan option is not included.
   • BThe stats list () function is used.
   • CThe transaction and stats commands cannot be used together.
   • DThe transaction command has a limit of 1000 events per transaction.

   Show answer

   Answer: D

   Next question

2. Question 162 · 226 in bank

   When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

   • Aindex or source
   • Bsourcetype or source
   • Csourcetype or host
   • Dindex or sourcetype

   Show answer

   Answer: B

   Next question

3. Question 163 · 226 in bank

   What are the expected search results from executing the following SPL command? index=network NOT StatusCode=200

   • ANo results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.
   • BEvery event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.
   • CEvery event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.
   • DEvery event in the network index that does not have a value in this field.

   Show answer

   Answer: C

   Next question

4. Question 164 · 226 in bank

   What is the purpose of a calculated field?

   • ATo automatically add fields to the index using an eval expression rather than manually including an eval command.
   • BTo manually add fields at search time and check for syntax errors.
   • CTo automatically add fields at search time using an eval expression rather than manually including an eval command.
   • DTo manually add and remove fields at search time related to statistical functions.

   Show answer

   Answer: C

   Next question

5. Question 165 · 226 in bank

   Which of the following can be saved as an event type?

   • Aindex=server_487 sourcetype=BETA_438 code=732
   • Bindex=server_487 sourcetype=BETA_438 code=732 | stats count by code
   • Cindex=server_487 sourcetype=BETA_438 code=732 [ | inputlookup append=t servercode.csv]
   • Dindex=server_487 sourcetype=BETA_438 code=732 | stats where code > 200

   Show answer

   Answer: A

   Next question

6. Question 166 · 226 in bank

   Which of the following statements is true about the root dataset of a data model?

   • AIt must contain the transaction command if it is a root transaction dataset.
   • BIt will automatically contain knowledge objects associated with the base search.
   • CIt can contain transforming commands as long as it is a root search dataset.
   • DIt can only contain a base search with no transforming commands.

   Show answer

   Answer: D

   Next question

7. Question 167 · 226 in bank

   Two separate results tables are being combined using the |join command. The outer table has the following values:

   

   The inner table has the following values:

   

   The line of SPL used to join the tables is: |join employeeNumber type=outer How many rows are returned in the new table?

   • A0
   • B3
   • C5
   • D8

   Show answer

   Answer: C

   Next question

8. Question 168 · 226 in bank

   What is the purpose of the fillnull command?

   • AReplace empty values with a specified value.
   • BRename a specific field in the search results.
   • CCreate a new field based on the values in an existing field.
   • DReplace all values in a specific field with a default value.

   Show answer

   Answer: A

   Next question

9. Question 169 · 226 in bank

   When using the eval command, which of these characters can be used to concatenate a string and a number into a single value?

   • A~ (tilde)
   • B& (ampersand)
   • C+ (plus)
   • D. (period)

   Show answer

   Answer: D

   Next question

10. Question 170 · 226 in bank

    A search contains 'example (100,200) '. What is the name of the macro?

    • Aexample(var1,var2)
    • Bexample[2]
    • Cexample($,$)
    • Dexample(2)

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 161. 226 questions available.