SPLK-1002 practice questions 31–40

1. Question 31 · 226 in bank

   Select 3

   Information needed to create a GET workflow action includes which of the following? (Choose all that apply.)

   • AA name for the workflow action.
   • BA URI where the user will be directed at search time.
   • CA label that will appear in the Event Action menu at search time.
   • DA name for the URI where the user will be directed at search time.

   Show answer

   Answer: ABC

   Next question

2. Question 32 · 226 in bank

   Select 3

   Which of the following can be used with the eval command tostring function? (Choose all that apply.)

   • A"hex"
   • B"commas"
   • C"decimal"
   • D"duration"

   Show answer

   Answer: ABD

   Next question

3. Question 33 · 226 in bank

   Select 2

   Which of the following searches show a valid use of a macro? (Choose all that apply.)

   • Aindex=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
   • Bindex=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
   • Cindex=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
   • Dindex=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

   Show answer

   Answer: AC

   Next question

4. Question 34 · 226 in bank

   A user wants to convert numeric field values to strings and also to sort on those values. Which command should be used first, the eval or the sort?

   • AIt doesn't matter whether eval or sort is used first.
   • BConvert the numeric to a string with eval first, then sort.
   • CUse sort first, then convert the numeric to a string with eval.
   • DYou cannot use the sort command and the eval command on the same field.

   Show answer

   Answer: C

   Next question

5. Question 35 · 226 in bank

   Select 2

   Which Knowledge Object does the Splunk Common Information Model (CIM) use to normalize data, in addition to field aliases, event types, and tags?

   • AMacros
   • BLookups
   • CWorkflow actions
   • DField extractions

   Show answer

   Answer: BD

   Next question

6. Question 36 · 226 in bank

   Select 3

   Which of the following statements describe data model acceleration? (Choose all that apply.)

   • ARoot events cannot be accelerated.
   • BAccelerated data models cannot be edited.
   • CPrivate data models cannot be accelerated.
   • DYou must have administrative permissions or the accelerate_datamodel capability to accelerate a data model.

   Show answer

   Answer: BCD

   Next question

7. Question 37 · 226 in bank

   How does a user display a chart in stack mode?

   • ABy using the stack command.
   • BBy turning on the Use Trellis Layout option.
   • CBy changing Stack Mode in the Format menu.
   • DYou cannot display a chart in stack mode, only a timechart.

   Show answer

   Answer: C

   Next question

8. Question 38 · 226 in bank

   If no value is specified with the fillnull command, what default value will be used?

   • A0
   • BN/A
   • Cג€"
   • DNULL

   Show answer

   Answer: A

   Next question

9. Question 39 · 226 in bank

   What other syntax will produce exactly the same results as | chart count over vendor_action by user?

   • A| chart count by vendor_action, user
   • B| chart count over vendor_action, user
   • C| chart count by vendor_action over user
   • D| chart count over user by vendor_action

   Show answer

   Answer: A

   Next question

10. Question 40 · 226 in bank

    What are the two parts of a root event dataset?

    • AFields and variables.
    • BFields and attributes.
    • CConstraints and fields.
    • DConstraints and lookups.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 31. 226 questions available.