SPLK-1002 Practice Questions

A.  

The Field Extractor automatically extracts all field at search time.

B.  

The Field Extractor uses PERL to extract field from the raw events.

C.  

Field extracted using the Extracted persist as knowledge objects.

D.  

Fields extracted using the Field Extractor do not persist and must be defined for each search.

A.  

, (comma)

B.  

I (pipe)

C.  

/ (forward slash)

D.  

: (colon)

A.  

Chronological

B.  

Reverser chronological

C.  

ASCIE

D.  

Alphabetical

A.  

override default of 10

B.  

only work with top command

C.  

override default of 20

D.  

override default of 15

A.  

Search

B.  

Where

C.  

If

D.  

Any of the above

A.  

date

B.  

host

C.  

time

D.  

-time

A.  

Events datasets

B.  

Search datasets

C.  

Transaction datasets

D.  

Any child of event, transaction, and search datasets

A.  

_raw

B.  

rime

C.  

_time

D.  

index

A.  

Calculated fields cannot be chained together to create more complex fields

B.  

Calculated fields can be chained together to create more complex fields.

C.  

Calculated fields can only be used in dashboards.

D.  

Calculated fields can only be used in saved reports.

A.  

Create a GET workflow action

B.  

Create a workflow action

C.  

Create a PUT workflow action

D.  

Create a Search workflow action