SPLK-1002 Practice Questions

A.  

The average time elapsed during each transaction for all transactions

B.  

The average time for each event within each transaction

C.  

The average time between each transaction

A.  

Creates lookups without using SPL.

B.  

Data Models are not required.

C.  

Creates reports without using SPL

D.  

Datasets are not required.

A.  

Change indexed fields

B.  

Exclude fields from our search results

C.  

Extract new fields from our data using regular expressions

D.  

Give a field a new name at search time

A.  

useother

B.  

usenull

C.  

fillfield

D.  

usefiled

A.  

the number of events returned

B.  

the selected time range

C.  

the type of visualization selected

A.  

index=server_516 sourcetype=BETA_201 code=S51 [ | inputlookup servercode.csv append=t ]

B.  

index=server_516 sourcetype=BETA_201 code=551

C.  

index=server_516 sourcetype=BETA_201 code=551 | stats count by code

D.  

index=server_516 sourcetype=BETA_201 code=551 | where code > 200

A.  

Place the variable name inside of curly braces: {variable name}.

B.  

Place the variable name inside of asterisks: variable name.

C.  

Place the variable name inside of dollar signs: $variable name$.

D.  

Place the variable name inside of percentage signs: %variable name%.

A.  

CSV

B.  

PDF

C.  

XML

D.  

JSON

A.  

parent

B.  

extracted

C.  

event

D.  

child

A.  

Root events cannot be accelerated.

B.  

Accelerated data models cannot be edited.

C.  

Private data models cannot be accelerated.

D.  

You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.