SPLK-1002 practice questions 221–226

1. Question 221 · 226 in bank

   Which of the following is true regarding field aliases?

   • AUsing field aliases overwrites the original field names.
   • BUsing field aliases removes the original field names.
   • CAliases can be created for fields extracted at index time or search time.
   • DAliases can reference calculated field objects.

   Show answer

   Answer: C

   Next question

2. Question 222 · 226 in bank

   A user creates a Data Model and adds a field. They set the field's flag to "Hidden". What impact does this have when using Pivot?

   • AThe field is not displayed when the dataset is selected.
   • BEvents that contain the field are hidden.
   • COnly events that contain this field are returned, and the field is hidden from use.
   • DThe field is removed from all events.

   Show answer

   Answer: A

   Next question

3. Question 223 · 226 in bank

   When adding a new field based on an eval expression in a data model, which option determines the field name that will appear to the user in Pivot?

   • ALabel name
   • BDisplay name
   • CField name
   • DPivot name

   Show answer

   Answer: B

   Next question

4. Question 224 · 226 in bank

   Which of the following can a field alias be applied to?

   • AEvent types
   • BSourcetypes
   • CTags
   • DIndexes

   Show answer

   Answer: B

   Next question

5. Question 225 · 226 in bank

   Why would the following search return no results? index=web sourcetype=http:log | fillnull user | where isnull(user)

   • AThe user field is never null after the fillnull command.
   • BThe user does not have permissions to filter on the user field.
   • CThere are no event types that match the search string.
   • DThe user field is always null after the fillnull command.

   Show answer

   Answer: A

   Next question

6. Question 226 · 226 in bank

   Which wildcard would a user specify to match on multiple characters when using the where command?

   • A%
   • B$
   • C_
   • D*

   Show answer

   Answer: D

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 221. 226 questions available.