SPLK-1002 practice questions 41–50

1. Question 41 · 226 in bank

   When using timechart, how many fields can be listed after a by clause?

   • A0, because timechart doesn't support using a by clause.
   • B1, because _time is already implied as the x-axis.
   • C2, because one field would represent the x-axis and the other would represent the y-axis.
   • DThere is no limit specific to timechart.

   Show answer

   Answer: B

   Next question

2. Question 42 · 226 in bank

   A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

   • ABoth will appear in the All Fields list, but only if the alias is specified in the search.
   • BBoth will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
   • CThe original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
   • DThe alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

   Show answer

   Answer: B

   Next question

3. Question 43 · 226 in bank

   Which of the following statements describes macros?

   • AA macro is a reusable search string that must contain the full search.
   • BA macro is a reusable search string that must have a fixed time range.
   • CA macro is a reusable search string that may have a flexible time range.
   • DA macro is a reusable search string that must contain only a portion of the search.

   Show answer

   Answer: C

   Next question

4. Question 44 · 226 in bank

   In what order are the following knowledge objects/configurations applied?

   • AField Aliases, Field Extractions, Lookups
   • BField Extractions, Field Aliases, Lookups
   • CField Extractions, Lookups, Field Aliases
   • DLookups, Field Aliases, Field Extractions

   Show answer

   Answer: B

   Next question

5. Question 45 · 226 in bank

   In which of the following scenarios is an event type more effective than a saved search?

   • AWhen a search should always include the same time range.
   • BWhen a search needs to be added to other users' dashboards.
   • CWhen the search string needs to be used in future searches.
   • DWhen formatting needs to be included with the search string.

   Show answer

   Answer: C

   Next question

6. Question 46 · 226 in bank

   When using the transaction command, what does the argument maxspan do?

   • ASets the maximum total time between events in a transaction.
   • BSets the maximum length of all the events within a transaction.
   • CSets the maximum total time between the earliest and latest events in a transaction.
   • DSets the maximum length that any single event can reach to be included in the transaction.

   Show answer

   Answer: C

   Next question

7. Question 47 · 226 in bank

   When creating a Search workflow action, which field is required?

   • ASearch string
   • BData model name
   • CPermission setting
   • DAn eval statement

   Show answer

   Answer: A

   Next question

8. Question 48 · 226 in bank

   To identify all of the contributing events within a transaction that contain at least one REJECT event, which syntax is correct?

   • Aindex=main REJECT | transaction sessionid
   • Bindex=main | transaction sessionid | search REJECT
   • Cindex=main | transaction sessionid | where transaction=reject
   • Dindex=main | transaction sessionid | where transaction="REJECT*"

   Show answer

   Answer: B

   Next question

9. Question 49 · 226 in bank

   After manually editing a regular expression (regex), which of the following statements is true?

   • AChanges made manually can be reverted in the Field Extractor (FX) UI.
   • BIt is no longer possible to edit the field extraction in the Field Extractor (FX) UI.
   • CIt is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.
   • DThe Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

   Show answer

   Answer: B

   Next question

10. Question 50 · 226 in bank

    Which of the following statements describes POST workflow actions?

    • AConfiguration of a POST workflow action includes choosing a sourcetype.
    • BPOST workflow actions can be configured to send email to the URI location.
    • CBy default, POST workflow actions are shown in both the event and field menus.
    • DPOST workflow actions can be configured to send POST arguments to the URI location.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-1002 practice, question 41. 226 questions available.