SPLK-1002 practice questions 171–180

1. Question 171 · 226 in bank

   Which of the following eval commands will provide a new value for host from src if it exists?

   • A| eval host * if(isnull(src), src, host)
   • B| eval host = if(src = host, src, host)
   • C| eval host = if(NOT src = host, src, host)
   • D| eval host = if(isnotnull(src), src, host)

   Show answer

   Answer: D

   Next question

2. Question 172 · 226 in bank

   Which of the following describes this search?

   

   • AThis search will run the third_party_oucages macro and pass the arguments EMEA and -24h to the macro definition.
   • BThis search will run the third_party_outages saved search and filter for events containing "EMEA" and "-24h" in the raw event data.
   • CThis search will find all events for the third_party_outages event type that have "EMEA" or "-24h" in the raw event data.
   • DThis search will find all events in the third_party_outages index with the tags EMEA and -24h.

   Show answer

   Answer: A

   Next question

3. Question 173 · 226 in bank

   Which of the following searches can be used to define an event type?

   • Aindex=games sourcetype=score player=* score>9999
   • Bindex=games sourcetype=score [search index=players | fields player_id]
   • Cindex=games sourcetype=score | where score>9999
   • Dindex-games sourcetype-score | stats count by player

   Show answer

   Answer: A

   Next question

4. Question 174 · 226 in bank

   While normalizing data to match the Common Information Model (CIM), a user discovers that the field of Region contains some values that are misspelled. For example, "New Bork" instead of "New York". Which of the following would correct this issue?

   • ACreate a calculated field outside of the CIM data model to manually adjust the values, and then make that calculated field available inside of the data model.
   • BUse btprobe to reset the pointer on the file.
   • CCreate a field alias to match the field with the misspelled values to a field that has the values spelled correctly.
   • DCreate a calculated field within the data model to manually adjust the values.

   Show answer

   Answer: D

   Next question

5. Question 175 · 226 in bank

   A Splunk app is configured to extract domain names in web service logs and specify them as a field named domain. What workflow action would return an external IP lookup for the field named domain?

   • APUT
   • BSearch
   • CPOST
   • DGET

   Show answer

   Answer: D

   Next question

6. Question 176 · 226 in bank

   Which of the following is a use case for a Search workflow action?

   • ASend a notification to an administrator.
   • BSubmit a ticket to a ticketing system.
   • CRun a search with admin privileges.
   • DFind related events in another index.

   Show answer

   Answer: D

   Next question

7. Question 177 · 226 in bank

   A user runs the following search: index=X sourcetype=Y | chart count(domain) as count, sum(price) as sum by product, action usenull useother=f Which of the following table headers match the order this command creates?

   • AThe chart command does not allow for multiple statistical functions.
   • BProduct, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase
   • CProduct, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase
   • DCount: product, sum: product, count: action, sum: action

   Show answer

   Answer: B

   Next question

8. Question 178 · 226 in bank

   When using the Field Extractor (FX) to perform a field extraction, which delimiter can be used?

   • AA tab or space.
   • BA period or comma.
   • CAny consistent character.
   • DA comma.

   Show answer

   Answer: C

   Next question

9. Question 179 · 226 in bank

   Brad created a tag called "SpecialProjectX". It is associated with several field/value pairs, such as team=support, location=Austin, and release=Fuji. What search should Brad run to filter results for SpecialProjectX events related to the Support Team?

   • Atag!=Fuji,Austin
   • Btag=SpecialProjectX
   • Ctag::Support=SpecialProjectX
   • Dtag::team-SpecialProjectX

   Show answer

   Answer: B

   Next question

10. Question 180 · 226 in bank

    For which of the following knowledge objects can a field alias be created?

    • ACalculated fields
    • BEvent types
    • CField extractions
    • DMacros

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 171. 226 questions available.