SPLK-1002 practice questions 21–30

1. Question 21 · 226 in bank

   When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

   • AThe regex can no longer be edited.
   • BThe field being extracted will be required for all future events.
   • CThe events without the required field will not display in searches.
   • DOnly events with the required string will be included in the extraction.

   Show answer

   Answer: D

   Next question

2. Question 22 · 226 in bank

   When using | timechart by host, which field is represented in the x-axis?

   • Adate
   • Bhost
   • Ctime
   • D_time

   Show answer

   Answer: D

   Next question

3. Question 23 · 226 in bank

   Which of the following is the correct way to use the datamodel command to search fields in the Web data model within the Web dataset?

   • A| datamodel Web Web search | fields Web*
   • B| search datamodel Web Web | fields Web*
   • C| datamodel Web Web fields | search Web*
   • Ddatamodel=Web | search Web | fields Web*

   Show answer

   Answer: A

   Next question

4. Question 24 · 226 in bank

   Select 3

   Which of the following statements describe the command below? (Choose all that apply.) sourcetype=access_combined | transaction JSESSIONID

   • AAn additional field named maxspan is created.
   • BAn additional field named duration is created.
   • CAn additional field named eventcount is created.
   • DEvents with the same JSESSIONID will be grouped together into a single event.

   Show answer

   Answer: BCD

   Next question

5. Question 25 · 226 in bank

   Which of the following searches will return events containing a tag named Privileged?

   • Atag=Priv
   • Btag=Priv*
   • Ctag=priv*
   • Dtag=privileged

   Show answer

   Answer: B

   Next question

6. Question 26 · 226 in bank

   Given the macro definition below, what should be entered into the Name and Arguments fields to correctly configure the macro?

   

   • AThe macro name is sessiontracker and the arguments are action, JESSIONID.
   • BThe macro name is sessiontracker(2) and the arguments are action, JESSIONID.
   • CThe macro name is sessiontracker and the arguments are $action$, $JESSIONID$.
   • DThe macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

   Show answer

   Answer: B

   Next question

7. Question 27 · 226 in bank

   What is required for a macro to accept three arguments?

   • AThe macro's name ends with (3).
   • BThe macro's name starts with (3).
   • CThe macro's argument count setting is 3 or more.
   • DNothing, all macros can accept any number of arguments.

   Show answer

   Answer: A

   Next question

8. Question 28 · 226 in bank

   Which workflow action method can be used when the action type is set to link?

   • AGET
   • BPUT
   • CSearch
   • DUPDATE

   Show answer

   Answer: A

   Next question

9. Question 29 · 226 in bank

   Select 2

   Which of the following statements about tags is true? (Choose all that apply.)

   • ATags are case-insensitive.
   • BTags are based on field/value pairs.
   • CTags categorize events based on a search.
   • DTags are designed to make data more understandable.

   Show answer

   Answer: BD

   Next question

10. Question 30 · 226 in bank

    Select 2

    Which of the following statements about macros is true? (Choose all that apply.)

    • AArguments are defined at execution time.
    • BArguments are defined when the macro is created.
    • CArgument values are used to resolve the search string at execution time.
    • DArgument values are used to resolve the search string when the macro is created.

    Show answer

    Answer: BC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 21. 226 questions available.