Result Modification Flashcards

1
Q

Which statement(s) about appendpipe is false?

  • The subpipeline is executed only when Splunk reaches the appendpipe command
  • appendpipe transforms results and adds new lines to the bottom of the results set because appendpipe is always the last command to be executed x
  • appendpipe transforms results and adds new lines to the bottom of the results set without overwriting original results
  • Only one appendpipe can exist in a search because the search head can only process two searches simultaneously
A

Only one appendpipe can exist in a search because the search head can only process two searches simultaneously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

___ is the process of organizing data to appear similar across all records, making the information easier to search.

  • Segmentation
  • Collating
  • Splunkification
  • Normalization
A

Normalization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

True or False: If there is an appendpipe in a search, its subpipeline will always be executed last.

  • TRUE
  • FALSE
A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of these tostring expressions will format the PROFIT field in the USD currency format, $x,xxx?

  • | eval PROFIT = tostring(“$x,xxx”,PROFIT)
  • | eval PROFIT = tostring(PROFIT,”$”.”commas”)
  • | eval PROFIT = tostring(PROFIT,”$x,xxx”)
  • | eval PROFIT = “$”.tostring(PROFIT,”commas”)
A

eval PROFIT = “$”.tostring(PROFIT,”commas”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or False: eventstats and streamstats support multiple stats functions, just like stats.

FALSE

TRUE

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which command uses a template subsearch to replace the values of specific fields?

  • replace
  • foreach
  • eval
  • none; commands only use functions to replace field values, not templates or subsearches
A

foreach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which two commands when used together are equivalent to chart <fieldA> over <filedB> by <fieldC>? Select all that apply.</fieldC></filedB></fieldA>

* stats <fieldA> by <fieldB>,<fieldC> followed by additional commands and then untable <fieldB> <fieldC> <fieldA>
* stats <fieldA> by <fieldB>,<fieldC> followed by additional commands and then xyseries <fieldB> <fieldC> <fieldA>
* stats <fieldA> by <fieldB>,<fieldC> followed by untable <fieldB> <fieldC> <fieldA> 
* stats <fieldA> by <fieldB>,<fieldC> followed by xyseries <fieldB> <fieldC> <fieldA>
A
stats <fieldA> by <fieldB>,<fieldC> followed by additional commands and then xyseries <fieldB> <fieldC> <fieldA>
stats <fieldA> by <fieldB>,<fieldC> followed by xyseries <fieldB> <fieldC> <fieldA>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True or False: The foreach command can be used without a subsearch.

FALSE

TRUE

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of these expressions will accurately normalize values from the OperatingSys and CompSys fields into a new field called OS?

  • | eval OS = coalesce(OperatingSys,CompSys)
  • | eval OS = case(OperatingSys=OperatingSys,”OS”,CompSys=CompSys,”OS”,true(),”OS”)
  • | eval replace(OperatingSys OR CompSys,OS”
A

eval OS = coalesce(OperatingSys,CompSys)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

You would use the ___ function to convert a string to uppercase and the ___ function to convert a string to lowercase.

  • uppercase(), lowercase()
  • lowercase(), uppercase()
  • lower(), upper()
  • upper(), lower()
A

upper(), lower()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly