SPLK-1002 practice questions 191–200

1. Question 191 · 226 in bank

   Which of the following is a use for a POST workflow action?

   • ALook up vulnerabilities in a software package.
   • BRetrieve WHOIS information for an IP address.
   • CCheck for an incoming email message.
   • DSubmit a ticket in a ticketing system.

   Show answer

   Answer: D

   Next question

2. Question 192 · 226 in bank

   Which of the following is correct syntax for using a macro called change_thing with two arguments in SPL?

   • A'change_thing("field1,field2")'
   • B'change_thing(field1,field2)'
   • C'change_thing'(field1,field2)
   • Dchange_thing(field1,field2)

   Show answer

   Answer: B

   Next question

3. Question 193 · 226 in bank

   A macro has another macro nested within it, and this inner macro requires an argument. How can the user pass this argument into the SPL?

   • AAn argument can be passed through the outer macro.
   • BAn argument can be passed to the outer macro by nesting parentheses.
   • CAn argument can be passed to the inner macro by nesting parentheses.
   • DThere is no way to pass an argument to the inner macro.

   Show answer

   Answer: A

   Next question

4. Question 194 · 226 in bank

   When using multiple expressions in a single eval command, which delimiter is used?

   • A/ (forward slash)
   • B: (colon)
   • C, (comma)
   • D| (pipe)

   Show answer

   Answer: C

   Next question

5. Question 195 · 226 in bank

   Which of the following must be contained in a data model?

   • AModel event
   • BChild event
   • CRoot event
   • DGroup event

   Show answer

   Answer: C

   Next question

6. Question 196 · 226 in bank

   A user wants a table that will show the total revenue made for each product in each sales region. Which would be the correct SPL query to use?

   • Aindex=X | chart total(price) by product, region
   • Bindex=X sourcetype=Y | chart sum(product) by price AND region
   • Cindex=X | chart total(product) over price by region
   • Dindex=X | chart sum(price) by product, region

   Show answer

   Answer: D

   Next question

7. Question 197 · 226 in bank

   When using transaction, what is the default maximum span between events?

   • AUnlimited
   • B1m
   • C1h
   • D1d

   Show answer

   Answer: A

   Next question

8. Question 198 · 226 in bank

   What does the fillnull command do in this search? index=main sourcetype=http:log | fillnull value="Unknown" src

   • ASet the values of the src field to null when it is "Unknown".
   • BSet the values of the src field to "Unknown" if it is null.
   • CSet all fields that are null to "Unknown".
   • DSet all fields with the value of "Unknown" to null.

   Show answer

   Answer: B

   Next question

9. Question 199 · 226 in bank

   What needs to be configured in order to normalize data using the Splunk Common Information Model (CIM) Add-On?

   • AConfigure workflow actions for the event types.
   • BConfigure the correct sourcetypes for the data models.
   • CConfigure event types that reference the appropriate tags.
   • DConfigure field aliases to match tags in the data models.

   Show answer

   Answer: C

   Next question

10. Question 200 · 226 in bank

    What field must be present in order to use the timechart command?

    • Aindex
    • B_time
    • C_raw
    • Dtime

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 191. 226 questions available.