SPLK-1002 Practice Questions

A.  

index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField

B.  

index=main source=mySource oldField=* | stats if(‘makeMyField(oldField)’) | table _time newField

C.  

index=main source=mySource oldField=* | eval newField=’makeMyField(oldField)’| table _time newField

D.  

index=main source=mySource oldField=* | "’newField(‘makeMyField(oldField)’)’" | table _time newField

A.  

Data found in a lookup table.

B.  

Either a calculated field or an extracted field.

C.  

Only one single field in a dataset.

D.  

A given host, source, or sourcetype.

A.  

monthly_sales(argument 1, argument 2, argument 3)

B.  

monthly_sales(3)

C.  

monthly_sales[3]

D.  

monthly_sales[argument 1, argument 2, argument 3)

A.  

is looking for all events that include the search terms: fields AND action AND productld AND status

B.  

users the table command to improve performance

C.  

limits the fields are extracted

D.  

returns a table with 3 columns

A.  

Creates a table of the total count of users and split by corndogs.

B.  

Creates a table of the total count of mysterymeat corndogs split by user.

C.  

Creates a table with the count of all types of corndogs eaten split by user.

D.  

Creates a table that groups the total number of users by vegetarian corndogs.

A.  

One.

B.  

Two.

C.  

It depends on whether the original fields have the same name.

D.  

It depends on whether the two sourcetypes are associated with the same index.

A.  

parent

B.  

extracted

C.  

event

D.  

child

A.  

Changes made manually can be reverted in the Field Extractor (FX) UI.

B.  

It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

C.  

It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.

D.  

The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

A.  

sourcetype=access_* | maximum totals by bytes

B.  

sourcetype=access_* | avg (bytes)

C.  

sourcetype=access_* | stats max(bytes)

D.  

sourcetype=access_* | max(bytes)

A.  

User permissions

B.  

Alerts

C.  

Databases

D.  

Email