SPLK-1002 Practice Questions

A.  

Rename a field in the index

B.  

remove duplicate values

C.  

provide an additional alias for the field that can

D.  

A.  

Indexes

B.  

Tags

C.  

Event types

D.  

Sourcetypes

A.  

Multi-Series

B.  

Split-Series

C.  

Omit nulls

D.  

Stacked

A.  

They cannot be created within the data model.

B.  

They can only be added into a root search dataset.

C.  

They cannot be edited if inherited from a parent dataset.

D.  

They can be added to a dataset from search time field extractions.

A.  

To automatically add fields to the index using an eval expression rather than manually including an eval command.

B.  

To manually add and remove fields at search time related to statistical functions.

C.  

To automatically add fields at search time using an eval expression rather than manually including an eval command.

D.  

To manually add fields at search time and check for syntax errors.

A.  

| eval host = if (isnu11 (src), src, host)

B.  

| eval host = if (NOT src = host, src, host)

C.  

| eval host = if (src = host, src, host)

D.  

| eval host = if (isnotnull (src), src, host)

A.  

‘’hex’’

B.  

‘’commas’’

C.  

‘’Decimal’’

D.  

‘’duration’’

A.  

Fields and variables.

B.  

Fields and attributes.

C.  

Constraints and fields.

D.  

Constraints and lookups.

A.  

Clear text only.

B.  

A mix of clear text strings and variables.

C.  

It can only send raw event data.

D.  

Variables only.

A.  

Groups a set of transactions based on time.

B.  

Creates a single event from a group of events.

C.  

Separates two events based on one or more values.

D.  

Returns the number of credit card transactions found in the event logs.