Month End Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Question # 4

The timechart command buckets data in time intervals depending on:

A.

the number of events returned

B.

the selected time range

C.

the type of visualization selected

Full Access
Question # 5

Which of the following options will define the first event in a transaction?

A.

startswith

B.

with

C.

startingwith

D.

firstevent

Full Access
Question # 6

Calculated fields can be based on which of the following?

A.

Tags

B.

Extracted fields

C.

Output fields for a lookup

D.

Fields generated from a search string

Full Access
Question # 7

This clause is used to group the output of a stats command by a specific name.

A.

Rex

B.

As

C.

List

D.

By

Full Access
Question # 8

Which of the following search modes automatically returns all extracted fields in the fields sidebar?

A.

Fast

B.

Smart 

C.

C. Verbose

Full Access
Question # 9

Which of the following searches will return events containing a tag named Privileged?

A.

tag=Priv

B.

tag=Priv*

C.

tag=priv*

D.

tag=privileged

Full Access
Question # 10

This function of the stats command allows you to return the sample standard deviation of a field.

A.

stdev

B.

dev

C.

count deviation

D.

by standarddev

Full Access
Question # 11

For choropleth maps,splunk ships with the following KMZ files (select all that apply)

A.

States of the United States

B.

States and provinces of the united states and Canada

C.

Countries of the European Union

D.

Countries of the World

Full Access
Question # 12

Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

A.

POST

B.

Search

C.

GET

D.

Format

Full Access
Question # 13

How is a macro referenced in a search?

A.

By using the macroname command.

B.

By using the macro command.

C.

By enclosing the macro name in backtick characters (‘).

D.

By enclosing the macro name in single-quote characters (‘).

Full Access
Question # 14

which of the following are valid options with the chart command

A.

useother

B.

usenull

C.

fillfield

D.

usefiled

Full Access
Question # 15

When creating a data model, which root dataset requires at least one constraint?

A.

Root transaction dataset

B.

Root event dataset

C.

Root child dataset

D.

Root search dataset

Full Access
Question # 16

During the validation step of the Field Extractor workflow:

Select your answer.

A.

You can remove values that aren't a match for the field you want to define

B.

You can validate where the data originated from

C.

You cannot modify the field extraction

Full Access
Question # 17

A data model consists of which three types of datasets?

A.

Constraint, field, value.

B.

Events, searches, transactions.

C.

Field extraction, regex, delimited.

D.

Transaction, session ID, metadata.

Full Access
Question # 18

In the Field Extractor Utility, this button will display events that do not contain extracted fields.

Select your answer.

A.

Selected-Fields

B.

Non-Matches

C.

Non-Extractions

D.

Matches

Full Access
Question # 19

When should transaction be used?

A.

Only in a large distributed Splunk environment.

B.

When calculating results from one or more fields.

C.

When event grouping is based on start/end values.

D.

When grouping events results in over 1000 events in each group.

Full Access
Question # 20

What is the correct syntax to find events associated with a tag?

A.

tag:=

B.

tags=

C.

tags:=

D.

tag=

Full Access
Question # 21

Which of the following statements about calculated fields in Splunk is true?

A.

Calculated fields cannot be chained together to create more complex fields

B.

Calculated fields can be chained together to create more complex fields.

C.

Calculated fields can only be used in dashboards.

D.

Calculated fields can only be used in saved reports.

Full Access
Question # 22

Selected fields are displayed ______each event in the search results.

A.

below

B.

interesting fields

C.

other fields

D.

above

Full Access
Question # 23

When creating a Search workflow action, which field is required?

A.

Search string

B.

Data model name

C.

Permission setting

D.

An eval statement

Full Access
Question # 24

Which of the following statements about tags is true?

A.

Tags are case insensitive.

B.

Tags are created at index time.

C.

Tags can make your data more understandable.

D.

Tags are searched by using the syntax tag: :

Full Access
Question # 25

Which of the following statements describes macros?

A.

A macro is a reusable search string that must contain the full search.

B.

A macro is a reusable search string that must have a fixed time range.

C.

A macro Is a reusable search string that may have a flexible time range.

D.

A macro Is a reusable search string that must contain only a portion of the search.

Full Access
Question # 26

Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

A.

The macro name is sessiontracker and the arguments are action, JESSIONID.

B.

The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

C.

The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

D.

The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

Full Access
Question # 27

Which of the following Statements about macros is true? (select all that apply)

A.

Arguments are defined at execution time.

B.

Arguments are defined when the macro is created.

C.

Argument values are used to resolve the search string at execution time.

D.

Argument values are used to resolve the search string when the macro is created.

Full Access
Question # 28

Which of the following workflow actions can be executed from search results? (select all that apply)

A.

GET

B.

POST

C.

LOOKUP

D.

Search

Full Access
Question # 29

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

A.

Tabs

B.

Pipes

C.

Spaces

D.

Commas

Full Access
Question # 30

When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

A.

Rank

B.

Weight

C.

Priority

D.

Precedence

Full Access
Question # 31

When should you use the transaction command instead of the scats command?

A.

When you need to group on multiple values.

B.

When duration is irrelevant in search results. .

C.

When you have over 1000 events in a transaction.

D.

When you need to group based on start and end constraints.

Full Access
Question # 32

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

A.

The regex can no longer be edited.

B.

The field being extracted will be required for all future events.

C.

The events without the required field will not display in searches.

D.

Only events with the required string will be included in the extraction.

Full Access
Question # 33

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

A.

Index-main | REJECT trans sessionid

B.

Index-main | transaction sessionid | search REJECT

C.

Index=main | transaction sessionid | whose transaction=reject

D.

Index=main | transaction sessionid | where transaction=reject’’

Full Access
Question # 34

After manually editing; a regular expression (regex), which of the following statements is true?

A.

Changes made manually can be reverted in the Field Extractor (FX) UI.

B.

It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

C.

It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.

D.

The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

Full Access
Question # 35

Which of the following statements about event types is true? (select all that apply)

A.

Event types can be tagged.

B.

Event types must include a time range,

C.

Event types categorize events based on a search.

D.

Event types can be a useful method for capturing and sharing knowledge.

Full Access
Question # 36

Which of the following file formats can be extracted using a delimiter field extraction?

A.

CSV

B.

PDF

C.

XML

D.

JSON

Full Access
Question # 37

Which of the following eval command function is valid?

A.

Int ()

B.

Count ( )

C.

Print ()

D.

Tostring ()

Full Access
Question # 38

Which of the following knowledge objects represents the output of an eval expression?

A.

Eval fields

B.

Calculated fields

C.

Field extractions

D.

Calculated lookups

Full Access
Question # 39

Which of the following statements describes field aliases?

A.

Field alias names replace the original field name.

B.

Field aliases can be used in lookup file definitions.

C.

Field aliases only normalize data across sources and sourcetypes.

D.

Field alias names are not case sensitive when used as part of a search.

Full Access
Question # 40

When using timechart, how many fields can be listed after a by clause?

A.

because timechart doesn't support using a by clause.

B.

because _time is already implied as the x-axis.

C.

because one field would represent the x-axis and the other would represent the y-axis.

D.

There is no limit specific to timechart.

Full Access
Question # 41

Data model are composed of one or more of which of the following datasets? (select all that apply.)

A.

Events datasets

B.

Search datasets

C.

Transaction datasets

D.

Any child of event, transaction, and search datasets

Full Access
Question # 42

Which of the following statements describes POST workflow actions?

A.

POST workflow actions are always encrypted.

B.

POST workflow actions cannot use field values in their URI.

C.

POST workflow actions cannot be created on custom sourcetypes.

D.

POST workflow actions can open a web page in either the same window or a new .

Full Access
Question # 43

What are the two parts of a root event dataset?

A.

Fields and variables.

B.

Fields and attributes.

C.

Constraints and fields.

D.

Constraints and lookups.

Full Access
Question # 44

Which of the following describes the Splunk Common Information Model (CIM) add-on?

A.

The CIM add-on uses machine learning to normalize data.

B.

The CIM add-on contains dashboards that show how to map data.

C.

The CIM add-on contains data models to help you normalize data.

D.

The CIM add-on is automatically installed in a Splunk environment.

Full Access
Question # 45

What is required for a macro to accept three arguments?

A.

The macro's name ends with (3).

B.

The macro's name starts with (3).

C.

The macro's argument count setting is 3 or more.

D.

Nothing, all macros can accept any number of arguments.

Full Access
Question # 46

A user wants to convert numeric field values to strings and also to sort on those values.

Which command should be used first, the eval or the sort?

A.

It doesn't matter whether eval or sort is used first.

B.

Convert the numeric to a string with eval first, then sort.

C.

Use sort first, then convert the numeric to a string with eval.

D.

You cannot use the sort command and the eval command on the same field.

Full Access
Question # 47

What does the following search do?

A.

Creates a table of the total count of users and split by corndogs.

B.

Creates a table of the total count of mysterymeat corndogs split by user.

C.

Creates a table with the count of all types of corndogs eaten split by user.

D.

Creates a table that groups the total number of users by vegetarian corndogs.

Full Access
Question # 48

Which of the following actions can the eval command perform?

A.

Remove fields from results.

B.

Create or replace an existing field.

C.

Group transactions by one or more fields.

D.

Save SPL commands to be reused in other searches.

Full Access
Question # 49

Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

A.

Alerts

B.

Email

C.

Database

D.

User permissions

Full Access
Question # 50

Which of the following statements about data models and pivot are true? (select all that apply)

A.

They are both knowledge objects.

B.

Data models are created out of datasets called pivots.

C.

Pivot requires users to input SPL searches on data models.

D.

Pivot allows the creation of data visualizations that present different aspects of a data model.

Full Access
Question # 51

Which group of users would most likely use pivots?

A.

Users

B.

Architects

C.

Administrators

D.

Knowledge Managers

Full Access
Question # 52

Which of the following statements describe calculated fields? (select all that apply)

A.

Calculated fields can be used in the search bar.

B.

Calculated fields can be based on an extracted field.

C.

Calculated fields can only be applied to host and sourcetype.

D.

Calculated fields are shortcuts for performing calculations using the eval command.

Full Access
Question # 53

Which of the following statements describe GET workflow actions?

A.

GET workflow actions must be configured with POST arguments.

B.

Configuration of GET workflow actions includes choosing a sourcetype.

C.

Label names for GET workflow actions must include a field name surrounded by dollar signs.

D.

GET workflow actions can be configured to open the URT link in the current window or in a new window

Full Access
Question # 54

What are search macros?

A.

Lookup definitions in lookup tables.

B.

Reusable pieces of search processing language.

C.

A method to normalize fields.

D.

Categories of search results.

Full Access
Question # 55

When using the transaction command, what does the argument maxspan do?

A.

Sets the maximum total time between events in a transaction.

B.

Sets the maximum length of all events within a transaction.

C.

Sets the maximum total time between the earliest and latest events in a transaction.

D.

Sets the maximum length that any single event can reach to be included in the transaction.

Full Access
Question # 56

This function of the stats command allows you to identify the number of values a field has.

A.

max

B.

distinct_count

C.

fields

D.

count

Full Access
Question # 57

Highlighted search terms indicate _________ search results in Splunk.

A.

Display as selected fields.

B.

Sorted

C.

Charted based on time

D.

Matching

Full Access
Question # 58

A user runs the following search:

index—X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother—f

Which of the following table headers match the order this command creates?

A.

The chart command does not allow for multiple statistical functions.

B.

Product, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count: purchase

C.

Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase

D.

Count: product, sum: product, count: action, sum: action

Full Access
Question # 59

Which of the following searches show a valid use of a macro? (Choose all that apply.)

A.

index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField

B.

index=main source=mySource oldField=* | stats if(‘makeMyField(oldField)’) | table _time newField

C.

index=main source=mySource oldField=* | eval newField=’makeMyField(oldField)’| table _time newField

D.

index=main source=mySource oldField=* | "’newField(‘makeMyField(oldField)’)’" | table _time newField

Full Access
Question # 60

What are the expected results for a search that contains the command | where A=B?

A.

Events that contain the string value where A=B.

B.

Events that contain the string value A=B.

C.

Events where values of field are equal to values of field B.

D.

Events where field A contains the string value B.

Full Access
Question # 61

In the Field Extractor, when would the regular expression method be used?

A.

When events contain JSON data.

B.

When events contain comma-separated data.

C.

When events contain unstructured data.

D.

When events contain table-based data.

Full Access
Question # 62

When using the transaction command, how are evicted transactions identified?

A.

Closed_txn field is set to o, or false.

B.

Max_txn field is set to O, or false.

C.

Txn_field is set to 1, or true.

D.

open_txn field is set to 1, or true.

Full Access
Question # 63

What is the correct format for naming a macro with multiple arguments?

A.

monthly_sales(argument 1, argument 2, argument 3)

B.

monthly_sales(3)

C.

monthly_sales[3]

D.

monthly_sales[argument 1, argument 2, argument 3)

Full Access