SPLK-1002 Practice Questions

A.  

example(2)

B.  

example(var1,var2)

C.  

example($,$)

D.  

example[2]

A.  

Streaming in some modes

B.  

Report generating

C.  

Distributable streaming

D.  

Centralized streaming

A.  

http://whois.net/whois/'domain'

B.  

http://whois.net/whois/$domain$

C.  

http://whois.net/whois/%domain%

D.  

http://whois.net/whois/*domain*

A.  

is looking for all events that include the search terms: fields AND action AND productld AND status

B.  

users the table command to improve performance

C.  

limits the fields are extracted

D.  

returns a table with 3 columns

A.  

Configuration of a POST workflow action includes choosing a sourcetype.

B.  

POST workflow actions can be configured to send email to the URI location.

C.  

By default, POST workflow action are shown in both the event and field menus.

D.  

POST workflow actions can be configured to send POST arguments to the URI location.

A.  

A macro is a method of categorizing events based on a search.

B.  

A macro is a way to associate an additional (new) name with an existing field name.

C.  

A macro is a portion of a search that can be reused in multiple place

D.  

A macro is a knowledge object that enables you to schedule searches for specific events.

A.  

Format values

B.  

Convert values

C.  

Perform calculations

D.  

Use conditional statements

A.  

They are both knowledge objects.

B.  

Data models are created out of datasets called pivots.

C.  

Pivot requires users to input SPL searches on data models.

D.  

Pivot allows the creation of data visualizations that present different aspects of a data model.

A.  

Selected-Fields

B.  

Non-Matches

C.  

Non-Extractions

D.  

Matches

A.  

0

B.  

N/A

C.  

NaN

D.  

NULL