SPLUNK 1002 TEST

1

1.- Using the export function, you can export search results as __________.( Select all that apply)

1

2.- The fields sidebar does not show________. (Select all that apply.)

1

3.- Splunk alerts can be based on search that run______. (Select all that apply.)

1

4.- Alert throttling is used to _______.

1

5.- A real-time alert is ______________.

1

6.- This tab shows you the event patterns in the results of a specific search.

1

7.- Which of the following about reports is/are true?

1

8.- Select this in the fields sidebar to automatically pipe you search results to the rare command

1

9.- A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

1

10.- Which of the following are valid options to speed up reports? (Select all the apply.)

1

11.- Which of the following statements are true for this search? (Select all that apply.) SEARCH:sourcetype=access* |fields action productld status

1

12.- Use the dedup command to _____.

1

13.- We can use the rename command to _____ (Select all that apply.)

1

14.- The limit attribute will___________.

1

15.- This function of the stats command allows you to identify the number of values a field has.

1

16.- This function of the stats command allows you to return the sample standard deviation of a field.

1

17.- Which of the following commands will show the maximum bytes?

1

18.- Which of the following searches will show the number of categoryld used by each host?

1

19.- Sourcetype=access_* |stats sum by host

1

20.- This function of the stats command allows you to return the middle-most value of field X.

1

21.- When a search returns __________, you can view the results as a list.

1

22.- Clicking a SEGMENT on a chart, ________.

1

23.- Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

1

24.- It is mandatory for the lookup file to have this for an automatic lookup to work.

1

25.- These users can create global knowledge objects. (Select all that apply.)

1

25.- This is what Splunk uses to categorize the data that is being indexed.

1

27.- This is what Splunk uses to categorize the data that is being indexed.

1

28.- By default search results are not returned in ________ order.

1

29.- The stats command will create a _____________ by default.

1

30.- Which is not a comparison operator in Splunk

1

31.- Which of the following is NOT a stats function:

1

32.- If a search returns ____________ it can be viewed as a chart.

1

33.- In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

1

34.- The timechart command buckets data in time intervals depending on:

1

35.- Which of these search strings is NOT valid:

1

36.- Which command is used to create choropleth maps?

1

37.- which of the following are valid options with the chart command

1

38.- The gauge command:

1

39.- What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

1

40.- Which of these is NOT a field that is automatically created with the transaction command?

1

41.- How many ways are there to access the Field Extractor Utility?

1

42.- When extracting fields, we may choose to use our own regular expressions

1

43.- Field aliases are used to __________ data

1

44.- What is the correct way to name a macro with two arguments?

1

45.- When using a field value variable with a Workflow Action, which punctuation mark will escape the data.

1

46.- __________ datasets can be added to root dataset to narrow down the search

1

47.- Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

1

48.- The eval command 'if' function requires the following three arguments (in order):

1

49.- Which search would limit an "alert" tag to the "host" field?

1

50.- The transaction command allows you to __________ events across multiple sources

1

51.- Which of the following commands are used when creating visualizations(select all that apply.)

1

52.- For choropleth maps,splunk ships with the following KMZ files (select all that apply)

1

54.- Complete the search, …. | _____ failure>successes

1

54.- These kinds of charts represent a series in a single bar with multiple sections

1

55.- When using a split series on a chart, the series MUST be displayed using the STACKED option.

1

56.- Which of the following are valid options with the chart command ?(select all that apply)

1

57.- This role is required to install the CIM Add-on.

1

58.- The Splunk CIM Add-on includes data models in a __________ format.
Select your answer.

1

59.- These allow you to categorize events based on search terms.
Select your answer.

1

60.- In the Field Extractor Utility, this button will display events that do not contain extracted fields.
Select your answer.