SPLK-1004 Practice Questions

A.  

edit_search_server

B.  

edit_udp

C.  

edit_tcp

D.  

edit_alerts

A.  

Compressed values inproductswill be uncompressed.

B.  

Separate events will be created for each product inproducts.

C.  

productswill be converted from a single value field to a multivalue field.

D.  

All multivalue fields will be converted to single value fields.

A.  

Hot buckets have no bloom filters as their contents are always changing.

B.  

Bloom filters could return false positives or false negatives.

C.  

Each bucket uses a unique hashing algorithm to create its bloom filter.

D.  

The bloom filter contains trinary values: 0, 1, and 2.

A.  

To transform single series output into a multi-series output.

B.  

To transform a stats-like output into chart-like output.

C.  

To transform a multi-series output into single series output.

D.  

To transform a chart-like output into a stats-like output.

A.  

maxDataSizeMB

B.  

max

C.  

volume

D.  

span

A.  

command.search.filter

B.  

command.search.fields

C.  

command.search.kv

D.  

command.search.regex

A.  

Fewer than 100k events in search results, with transforming commands used in the search string.

B.  

More than 100k events in search results, with only a search command in the search string.

C.  

More than 100k events in the search results, with a search and transforming command used in the search string.

D.  

Fewer than 100k events in search results, with only a search and transaction command used in the search string.

A.  

The distinct count of values for that field is exactly 0.

B.  

The distinct count of fields in the field summary is 1.

C.  

The distinct count of values in that field is approximated.

D.  

The distinct count of values for that field is exact.

A.  

The argument value may be passed to the outer macro.

B.  

An argument cannot be used with an inner nested macro.

C.  

An argument cannot be used with an outer nested macro.

D.  

The argument value must be specified in the outer macro.

A.  

Use the rex command.

B.  

Use the Field Extractor and manually edit the generated regular expression.

C.  

Use the Field Extractor and let it automatically generate a regular expression.

D.  

Use the erex command.