Splunk Flashcards
1
Q
When creating a Search workflow action, which field is required? A . Search string B . Data model name C . Permission setting D . An eval statement
A
A
2
Q
Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply) A . Alerts B . Email C . Database D . User permissions
A
A,B,C
3
Q
When using timechart, how many fields can be listed after a by clause?
A . because timechart doesn’t support using a by clause.
B . because _time is already implied as the x-axis.
C . because one field would represent the x-axis and the other would represent the y-axis.
D . There is no limit specific to timechart.
A
B
4
Q
Which of the following statements describes Search workflow actions?
A . By default. Search workflow actions will run as a real-time search.
B . Search workflow actions can be configured as scheduled searches,
C . The user can define the time range of the search when created the workflow action.
D . Search workflow actions cannot be configured with a search string that includes the transaction command
A
C
5
Q
Which of the following knowledge objects represents the output of an eval expression? A . Eval fields B . Calculated fields C . Field extractions D . Calculated lookups
A
B
6
Q
Data model fields can be added using the Auto-Extracted method .
Which of the following statements describe Auto-Extracted fields? (select all that apply)
A . Auto-Extracted fields can be hidden in Pivot.
B . Auto-Extracted fields can have their data type changed.
C . Auto-Extracted fields can be given a friendly name for use in Pivot.
D . Auto-Extracted fields can be added if they already exist in the dataset with constraints
A
A,B,C,D
7
Q
What does the transaction command do?
A . Groups a set of transactions based on time.
B . Creates a single event from a group of events.
C . Separates two events based on one or more values.
D . Returns the number of credit card transactions found in the event logs.
A
B
8
Q
Data model are composed of one or more of which of the following datasets? (select all that apply.)
A . Events datasets
B . Search datasets
C . Transaction datasets
D . Any child of event, transaction, and search datasets
A
A,B,C
9
Q
When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the
require option is used?
A . The regex can no longer be edited.
B . The field being extracted will be required for all future events.
C . The events without the required field will not display in searches.
D . Only events with the required string will be included in the extraction.
A
D
10
Q
Which of the following statements describes POST workflow actions?
A . POST workflow actions are always encrypted.
B . POST workflow actions cannot use field values in their UR
C . POST workflow actions cannot be created on custom sourcetypes.
D . POST workflow actions can open a web page in either the same window or a new.
A
D
11
Q
What is required for a macro to accept three arguments?
A . The macro’s name ends with (3).
B . The macro’s name starts with (3).
C . The macro’s argument count setting is 3 or more.
D . Nothing, all macros can accept any number of arguments.
A
A
12
Q
Which of the following statements describes the command below (select all that apply)
Sourcetype=access_combined | transaction JSESSIONID
A . An additional filed named maxspan is created.
B . An additional field named duration is created.
C . An additional field named eventcount is created.
D . Events with the same JSESSIONID will be grouped together into a single event.
A
B,C,D
13
Q
A space is an implied \_\_\_\_\_ in a search string. A . OR B . AND C . () D . NOT
A
B
14
Q
Which of the following statements about data models and pivot are true? (select all that apply)
A . They are both knowledge objects.
B . Data models are created out of datasets called pivots.
C . Pivot requires users to input SPL searches on data models.
D . Pivot allows the creation of data visualizations that present different aspects of a data model.
A
D
15
Q
Which of the following describes the Splunk Common Information Model (CIM) add-on?
A . The CIM add-on uses machine learning to normalize data.
B . The CIM add-on contains dashboards that show how to map data.
C . The CIM add-on contains data models to help you normalize data.
D . The CIM add-on is automatically installed in a Splunk environment.
A
C
16
Q
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply) A . Tabs B . Pipes C . Colons D . Spaces
A
A,B,C,D
17
Q
In what order are the following knowledge objects/configurations applied?
A . Field Aliases, Field Extractions, Lookups
B . Field Extractions, Field Aliases, Lookups
C . Field Extractions, Lookups, Field Aliases
D . Lookups, Field Aliases, Field Extractions
A
B
18
Q
Which of the following statements about event types is true? (select all that apply)
A . Event types can be tagged.
B . Event types must include a time range,
C . Event types categorize events based on a search.
D . Event types can be a useful method for capturing and sharing knowledge.
A
A,C,D
19
Q
A field alias has been created based on an original field. A search without any transforming commands is then
executed in Smart Mode .
Which field name appears in the results?
A . Both will appear in the All Fields list, but only if the alias is specified in the search.
B . Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
C . The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
D . The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.
A
B
20
Q
Which of the following statements describes macros?
A . A macro is a reusable search string that must contain the full search.
B . A macro is a reusable search string that must have a fixed time range.
C . A macro Is a reusable search string that may have a flexible time range.
D . A macro Is a reusable search string that must contain only a portion of the search.
A
C
21
Q
Which of the following workflow actions can be executed from search results? (select all that apply) A . GET B . POST C . LOOKUP D . Search
A
A,B,D
22
Q
Which group of users would most likely use pivots? A . Users B . Architects C . Administrators D . Knowledge Managers
A
A
23
Q
Which of the following is the correct way to use the data model command to search field in the data model within the
web dataset?
A . | datamodel web search | filed web *
B . | Search datamodel web web | filed web*
C . | datamodel web web field | search web*
D . Datamodel=web | search web | filed web*
A
A
24
Q
What does the following search do?
index=corndog type=mysterymeat action=eaten | stats count as corndog_count by user
A . Creates a table of the total count of users and split by corndogs.
B . Creates a table of the total count of mysterymeat corndogs split by user.
C . Creates a table with the count of all types of corndogs eaten split by user.
D . Creates a table that groups the total number of users by vegetarian corndogs.
A
B
25
What is the relationship between data models and pivots?
A . Data models provide the datasets for pivots.
B . Pivots and data models have no relationship.
C . Pivots and data models are the same thing.
D . Pivots provide the datasets for data models.
A
26
```
Which of the following searches will return events contains a tag name Privileged?
A . Tag= Priv
B . Tag= Pri*
C . Tag= Priv*
D . Tag= Privileged
```
B
27
When should you use the transaction command instead of the stats command?
A . When you need to group on multiple values.
B . When duration is irrelevant in search results. .
C . When you have over 1000 events in a transaction.
D . When you need to group based on start and end constraints.
D
28
To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is
correct?
A . Index-main | REJECT trans sessionid
B . Index-main | transaction sessionid | search REJECT
C . Index=main | transaction sessionid | whose transaction=reject
D . Index=main | transaction sessionid | where transaction=reject’’
B
29
Which are valid ways to create an event type? (select all that apply)
A . By using the searchtypes command in the search bar.
B . By editing the event_type stanza in the props.conf file.
C . By going to the Settings menu and clicking Event Types > New.
D . By selecting an event in search results and clicking Event Actions > Build Event Type.
C,D
30
The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created
report can then be shared with other people in the organization.
If another person in the organization runs the shared report and no results are returned, why might this be? (select all
that apply)
A . Fast mode is enabled.
B . The dashboard is private.
C . The extraction is private-
D . The person in the organization running the report does not have access to the index.
C,D
31
Which of the following statements describe the search below? (select all that apply)
Index=main I transaction clientip host maxspan=30s maxpause=5s
A . Events in the transaction occurred within 5 seconds.
B . It groups events that share the same clientip and host.
C . The first and last events are no more than 5 seconds apart.
D . The first and last events are no more than 30 seconds apart.
A,B,D
32
Which of the following statements describe data model acceleration? (select all that apply)
A . Root events cannot be accelerated.
B . Accelerated data models cannot be edited.
C . Private data models cannot be accelerated.
D . You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.
B,C,D
33
```
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
A . Custom visualizations
B . Pre-configured data models
C . Fields and event category tags
D . Automatic data model acceleration
```
B,C
34
```
Which of the following file formats can be extracted using a delimiter field extraction?
A . CSV
B . PDF
C . XML
D . JSON
```
A
35
Which of the following actions can the eval command perform?
A . Remove fields from results.
B . Create or replace an existing field.
C . Group transactions by one or more fields.
D . Save SPL commands to be reused in other searches.
B
36
```
What does the fillnull command replace null values with, it the value argument is not specified?
A . 0
B . N/A
C . NaN
D . NULL
```
A
37
```
What are the two parts of a root event dataset?
A . Fields and variables.
B . Fields and attributes.
C . Constraints and fields.
D . Constraints and lookups.
```
C
38
Calculated fields can be based on which of the following?
A . Tags
B . Extracted fields
C . Output fields for a lookup
D . Fields generated from a search string
B
39
```
Based on the macro definition shown below, what is the correct way to execute the macro in a search string? (large picture, just remember answer)
A . Convert_sales (euro, , 79)”
B . Convert_sales (euro, , .79)
C . Convert_sales ($euro,$$,s79$
D . Convert_sales ($euro, $$,S,79$)
```
B
40
Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured
the macro? (large picture again)
A . The macro name is sessiontracker and the arguments are action, JESSIONI
B . The macro name is sessiontracker(2) and the arguments are action, JESSIONI
C . The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.
D . The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.
B
41
What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different
names?
A . Macros.
B . Field aliases.
C . The rename command.
D . CIM does not work with different names for the same field.
B
42
```
When multiple event types with different color values are assigned to the same event, what determines the color
displayed for the events?
A . Rank
B . Weight
C . Priority
D . Precedence
```
C
43
```
What is the correct syntax to search for a tag associated with a value on a specific field?
A. tag=
B. tag=()
C. tag=::
D. tag::=
```
D
44
Which of the following Statements about macros is true? (select all that apply)
A . Arguments are defined at execution time.
B . Arguments are defined when the macro is created.
C . Argument values are used to resolve the search string at execution time.
D . Argument values are used to resolve the search string when the macro is created.
B,C
45
A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?
A . It doesn’t matter whether eval or sort is used first.
B . Convert the numeric to a string with eval first, then sort.
C . Use sort first, then convert the numeric to a string with eval.
D . You cannot use the sort command and the eval command on the same field.
C
46
Which of the following statements describe calculated fields? (select all that apply)
A . Calculated fields can be used in the search bar.
B . Calculated fields can be based on an extracted field.
C . Calculated fields can only be applied to host and sourcetype.
D . Calculated fields are shortcuts for performing calculations using the eval command.
A,B,D
47
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search
A . Evenrches would return a report of sales by state.
B . Events will be returned from the data model named Application_State.
C . Events will be returned from the data model named All_Application_state.
D . No events will be returned because the pipe should occur after the datamodel command
B
48
```
Which of the following searches show a valid use of macro? (Select all that apply)
A . index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField
B . index=main source=mySource oldField=* | stats if(‘makeMyField(oldField)’) | table _time newField
C . index=main source=mySource oldField=* | eval newField=’makeMyField(oldField)’| table _time newField
D . index=main source=mySource oldField=* | "’newField(‘makeMyField(oldField)’)’" | table _time newField
```
A,C
49
Which of the following are required to create a POST workflow action?
A . Label, URI, search string.
B . XMI attributes, URI, name.
C . Label, URI, post arguments.
D . URI, search string, time range picker.
C
50
```
Selected fields are displayed ______each event in the search results.
A . below
B . interesting fields
C . other fields
D . above
```
A
51
Which of the following statements describes field aliases?
A . Field alias names replace the original field name.
B . Field aliases can be used in lookup file definitions.
C . Field aliases only normalize data across sources and sourcetypes.
D . Field alias names are not case sensitive when used as part of a search.
B
52
Which of the following statements about tags is true?
A . Tags are case insensitive.
B . Tags are created at index time.
C . Tags can make your data more understandable.
D . Tags are searched by using the syntax tag: :
C
53
In which of the following scenarios is an event type more effective than a saved search?
A . When a search should always include the same time range.
B . When a search needs to be added to other users’ dashboards.
C . When the search string needs to be used in future searches.
D . When formatting needs to be included with the search string.
C
54
```
Which delimiters can the Field Extractor (FX) detect? (select all that apply)
A . Tabs
B . Pipes
C . Spaces
D . Commas
```
B,C,D
55
Which one of the following statements about the search command is true?
A . It does not allow the use of wildcards.
B . It treats field values in a case-sensitive manner.
C . It can only be used at the beginning of the search pipeline.
D . It behaves exactly like search strings before the first pipe.
D
56
How does a user display a chart in stack mode?
A . By using the stack command.
B . By turning on the Use Trellis Layout option.
C . By changing Stack Mode in the Format menu.
D . You cannot display a chart in stack mode, only a timechart.
C
57
What do events in a transaction have In common?
A . All events In a transaction must have the same timestamp.
B . All events in a transaction must have the same sourcetype.
C . All events in a transaction must have the exact same set of fields.
D . All events in a transaction must be related by one or more fields.
D
58
Which of the following statements describe GET workflow actions?
A . GET workflow actions must be configured with POST arguments.
B . Configuration of GET workflow actions includes choosing a sourcetype.
C . Label names for GET workflow actions must include a field name surrounded by dollar signs.
D . GET workflow actions can be configured to open the URT link in the current window or in a new window
D
59
```
Which of the following eval command function is valid?
A . Int ()
B . Count ( )
C . Print ()
D . Tostring ()
```
D
60
Which of the following statements is true, especially in large environments?
A . Use the stats command when you next to group events by two or more fields.
B . The stats command is faster and more efficient than the transaction command
C . The transaction command is faster and more efficient than the stats command.
D . Use the transaction command when you want to see the results of a calculation.
B
61
After manually editing; a regular expression (regex), which of the following statements is true?
A . Changes made manually can be reverted in the Field Extractor (FX) U
B . It is no longer possible to edit the field extraction in the Field Extractor (FX) U
C . It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) U
D . The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually
edited.
B
62
A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?
A . It doesn’t matter whether eval or sort is used first.
B . Convert the numeric to a string with eval first, then sort.
C . Use sort first, then convert the numeric to a string with eval.
D . You cannot use the sort command and the eval command on the same field.
C
63
```
Which of the following searches will return events contains a tag name Privileged?
A . Tag= Priv
B . Tag= Pri*
C . Tag= priv*
D . Tag= Privileged
```
B
64
Data model are composed of one or more of which of the following datasets? (select all that apply.)
A . Events datasets
B . Search datasets
C . Transaction datasets
D . Any child of event, transaction, and search datasets
A,B,C
65
```
When multiple event types with different color values are assigned to the same event, what determines the color
displayed for the events?
A . Rank
B . Weight
C . Priority
D . Precedence
```
C
66
```
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)
A . Tabs
B . Pipes
C . Colons
D . Spaces
```
A,B,C,D
67
What does the transaction command do?
A . Groups a set of transactions based on time.
B . Creates a single event from a group of events.
C . Separates two events based on one or more values.
D . Returns the number of credit card transactions found in the event logs.
B
68
```
What are the two parts of a root event dataset?
A . Fields and variables.
B . Fields and attributes.
C . Constraints and fields.
D . Constraints and lookups.
```
C
69
Which of the following statements describe data model acceleration? (select all that apply)
A . Root events cannot be accelerated.
B . Accelerated data models cannot be edited.
C . Private data models cannot be accelerated.
D . You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.
B,C,D
70
Which of the following statements describe the Common Information Model (QM)? (select all that apply)
A . CIM is a methodology for normalizing data.
B . CIM can correlate data from different sources.
C . The Knowledge Manager uses the CIM to create knowledge objects.
D . CIM is an app that can coexist with other apps on a single Splunk deployment.
A,B,C
71
```
Which delimiters can the Field Extractor (FX) detect? (select all that apply)
A . Tabs
B . Pipes
C . Spaces
D . Commas
```
B,C,D
72
What do events in a transaction have In common?
A . All events In a transaction must have the same timestamp.
B . All events in a transaction must have the same sourcetype.
C . All events in a transaction must have the exact same set of fields.
D . All events in a transaction must be related by one or more fields.
D
73
Which of the following statements describe the search below? (select all that apply)
Index=main I transaction clientip host maxspan=30s maxpause=5s
A . Events in the transaction occurred within 5 seconds.
B . It groups events that share the same clientip and host.
C . The first and last events are no more than 5 seconds apart.
D . The first and last events are no more than 30 seconds apart.
A,B,D
74
Which of the following statements describes POST workflow actions?
A . POST workflow actions are always encrypted.
B . POST workflow actions cannot use field values in their UR
C . POST workflow actions cannot be created on custom sourcetypes.
D . POST workflow actions can open a web page in either the same window or a new .
D
75
What is the relationship between data models and pivots?
A . Data models provide the datasets for pivots.
B . Pivots and data models have no relationship.
C . Pivots and data models are the same thing.
D . Pivots provide the datasets for data models.
A
76
A field alias has been created based on an original field. A search without any transforming commands is then
executed in Smart Mode.
Which field name appears in the results?
A . Both will appear in the All Fields list, but only if the alias is specified in the search.
B . Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
C . The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
D . The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.
B
77
Which of the following is the correct way to use the data model command to search field in the data model within the
web dataset?
A . | datamodel web search | field web *
B . | Search datamodel web web | filed web*
C . | datamodel web web field | search web*
D . Datamodel=web | search web | field web*
A
78
```
When creating a Search workflow action, which field is required?
A . Search string
B . Data model name
C . Permission setting
D . An eval statement
```
A
79
Which of the following describes the Splunk Common Information Model (CIM) add-on?
A . The CIM add-on uses machine learning to normalize data.
B . The CIM add-on contains dashboards that show how to map data.
C . The CIM add-on contains data models to help you normalize data.
D . The CIM add-on is automatically installed in a Splunk environment.
C
80
```
A space is an implied _____ in a search string.
A . OR
B . AND
C . ()
D . NOT
```
B
81
```
Which of the following file formats can be extracted using a delimiter field extraction?
A . CSV
B . PDF
C . XML
D . JSON
```
A
82
The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created
report can then be shared with other people in the organization.
If another person in the organization runs the shared report and no results are returned, why might this be? (select all
that apply)
A . Fast mode is enabled.
B . The dashboard is private.
C . The extraction is private-
D . The person in the organization running the report does not have access to the index.
C,D
83
Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)
A . This is a valid search and will display a timechart of the average duration, of each transaction event.
B . This is a valid search and will display a stats table showing the maximum pause among transactions.
C . No results will be returned because the transaction command must include the startswith and endswith options.
D . No results will be returned because the transaction command must be the last command used in the search
pipeline.
A
84
How does a user display a chart in stack mode?
A . By using the stack command.
B . By turning on the Use Trellis Layout option.
C . By changing Stack Mode in the Format menu.
D . You cannot display a chart in stack mode, only a timechart.
C
85
Which of the following statements is true, especially in large environments?
A . Use the stats command when you next to group events by two or more fields.
B . The stats command is faster and more efficient than the transaction command
C . The transaction command is faster and more efficient than the stats command.
D . Use the transaction command when you want to see the results of a calculation.
B
86
Calculated fields can be based on which of the following?
A . Tags
B . Extracted fields
C . Output fields for a lookup
D . Fields generated from a search string
B
87
```
What is the correct syntax to search for a tag associated with a value on a specific fields?
A. tag=
B. tag=()
C. tag=::
D. tag::=
```
D
88
Which of the following statements describes macros?
A . A macro is a reusable search string that must contain the full search.
B . A macro is a reusable search string that must have a fixed time range.
C . A macro Is a reusable search string that may have a flexible time range.
D . A macro Is a reusable search string that must contain only a portion of the search.
C
89
Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined |
transaction JSESSIONID
A . An additional filed named maxspan is created.
B . An additional field named duration is created.
C . An additional field named eventcount is created.
D . Events with the same JSESSIONID will be grouped together into a single event.
B,C,D
90
```
Which of the following searches show a valid use of macro? (Select all that apply)
A . index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField
B . index=main source=mySource oldField=* | stats if(‘makeMyField(oldField)’) | table _time newField
C . index=main source=mySource oldField=* | eval newField=’makeMyField(oldField)’| table _time newField
D . index=main source=mySource oldField=* | "’newField(‘makeMyField(oldField)’)’" | table _time newField
```
A,C
91
Which of the following actions can the eval command perform?
A . Remove fields from results.
B . Create or replace an existing field.
C . Group transactions by one or more fields.
D . Save SPL commands to be reused in other searches
B
92
Which of the following statements describes Search workflow actions?
A . By default. Search workflow actions will run as a real-time search.
B . Search workflow actions can be configured as scheduled searches,
C . The user can define the time range of the search when created the workflow action.
D . Search workflow actions cannot be configured with a search string that includes the transaction command
C
93
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search
A . Evenrches would return a report of sales by state.
B . Events will be returned from the data model named Application_State.
C . Events will be returned from the data model named All_Application_state.
D . No events will be returned because the pipe should occur after the datamodel command
B
94
Which of the following Statements about macros is true? (select all that apply)
A . Arguments are defined at execution time.
B . Arguments are defined when the macro is created.
C . Argument values are used to resolve the search string at execution time.
D . Argument values are used to resolve the search string when the macro is created.
B,C
95
In what order arc the following knowledge objects/configurations applied?
A . Field Aliases, Field Extractions, Lookups
B . Field Extractions, Field Aliases, Lookups
C . Field Extractions, Lookups, Field Aliases
D . Lookups, Field Aliases, Field Extractions
B
96
Data model fields can be added using the Auto-Extracted method.
Which of the following statements describe Auto-Extracted fields? (select all that apply)
A . Auto-Extracted fields can be hidden in Pivot.
B . Auto-Extracted fields can have their data type changed.
C . Auto-Extracted fields can be given a friendly name for use in Pivot.
D . Auto-Extracted fields can be added if they already exist in the dataset with constraints.
A,B,C,D
97
```
Which of the following eval command function is valid?
A . Int ()
B . Count ( )
C . Print ()
D . Tostring ()
```
D
98
```
Which of the following knowledge objects represents the output of an oval expression?
A . Eval fields
B . Calculated fields
C . Field extractions
D . Calculated lookups
```
B
99
Which of the following statements describe calculated fields? (select all that apply)
A . Calculated fields can be used in the search bar.
B . Calculated fields can be based on an extracted field.
C . Calculated fields can only be applied to host and sourcetype.
D . Calculated fields are shortcuts for performing calculations using the eval command.
A,B,D
100
Which one of the following statements about the search command is true?
A . It does not allow the use of wildcards.
B . It treats field values in a case-sensitive manner.
C . It can only be used at the beginning of the search pipeline.
D . It behaves exactly like search strings before the first pipe.
D
101
Which of the following statements about tags is true?
A . Tags are case insensitive.
B . Tags are created at index time.
C . Tags can make your data more understandable.
D . Tags are searched by using the syntax tag: :
C
102
What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different
names?
A . Macros.
B . Field aliases.
C . The rename command.
D . CIM does not work with different names for the same field.
B
103
What is required for a macro to accept three arguments?
A . The macro’s name ends with (3).
B . The macro’s name starts with (3).
C . The macro’s argument count setting is 3 or more.
D . Nothing, all macros can accept any number of arguments.
A
104
```
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)
A . Custom visualizations
B . Pre-configured data models
C . Fields and event category tags
D . Automatic data model acceleration
```
B,C
105
A calculated field maybe based on which of the following?
A . Lookup tables
B . Extracted fields
C . Regular expressions
D . Fields generated within a search string
B
106
Which are valid ways to create an event type? (select all that apply)
A . By using the searchtypes command in the search bar.
B . By editing the event_type stanza in the props.conf file.
C . By going to the Settings menu and clicking Event Types > New.
D . By selecting an event in search results and clicking Event Actions > Build Event Type.
C,D
107
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search
A . Events will be returned from dataset named Application_state.
B . Events will be returned from the data model named Application_State.
C . Events will be returned from the data model named All_Application_state.
D . No events will be returned because the pipe should occur after the datamodel command
B
108
What is required for a macro to accept three arguments?
A . The macro’s name ends with (3).
B . The macro’s name starts with (3).
C . The macro’s argument count setting is 3 or more.
D . Nothing, all macros can accept any number of arguments.
A
109
When can a pipe follow a macro?
A . A pipe may always follow a macro.
B . The current user must own the macro.
C . The macro must be defined in the current app.
D . Only when sharing is set to global for the macro.
A
110
Which option automatically identifies the data type, source type, and sample event?
A . Event Actions > Extract Fields
B . Fields sidebar > Extract New Fields
C . Settings > Field Extractions > New Field Extraction
D . Settings > Field Extractions > Open Field Extractor
A
111
By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?
A . Turned off.
B . Turned on.
C . Determined automatically based on the source type.
D . Determined automatically based on the data source.
D
112
```
Which workflow uses field values to perform a secondary search?
A. POST
B. Action
C. Search
D. Sub-search
```
C
113
Which of the following searches would return a report of sales by product_name?
A. chart sales by product_name
B. chart sum(price) as sales by product_name
C. stats sum(price) as sales over product_name
D. timechart list(sales), values(product_name)
B
114
```
The eval command allows you to do which of the following? (Choose all that apply.)
A. Format values
B. Convert values
C. Perform calculations
D. Use conditional statements
```
A,B,C,D
115
```
What information must be included when using the datamodel command?
A. status field
B. Multiple indexes
C. Data model field name.
D. Data model dataset name.
```
D
116
```
A data model can consist of what three types of datasets?
A. Pivot, searches, and events.
B. Pivot, events, and transactions.
C. Searches, transactions, and pivot.
D. Events, searches, and transactions.
```
D
117
When is a GET workflow action needed?
A. To send field values to an external resource.
B. To retrieve information from an external resource.
C. To use field values to perform a secondary search.
D. To define how events flow from forwarders to indexes.
B
118
```
Which command can include both an over and a by clause to divide results into sub-groupings?
A. chart
B. stats
C. xyseries
D. transaction
```
A
119
```
What does the Splunk Common Information Model (CIM) add-on include? (Choose all that apply.)
A. Custom visualizations
B. Pre-configured data models
C. Fields and event category tags
D. Automatic data model acceleration
```
B,C
120
A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?
A. One.
B. Two.
C. It depends on whether the original fields have the same name.
D. It depends on whether the two sourcetypes are associated with the same index.
B
121
In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")
A. The description field would contain no value.
B. The description field would contain the value 0.
C. The description field would contain the value "Internal Server Error".
D. This statement would produce an error in Splunk because it is incomplete.
A
122
```
In which Settings section are macros defined?
A. Fields
B. Tokens
C. Advanced Search
D. Searches, Reports, Alerts
```
C
123
Which of the following statements describes calculated fields?
A. Calculated fields are only used on fields added by lookups.
B. Calculated fields are a shortcut for repetitive and complex eval commands.
C. Calculated fields are a shortcut for repetitive and complex calc commands.
D. Calculated fields automatically calculate the simple moving average for indexed fields.
B
124
Which of the following are required to create a POST workflow action?
A. Label, URI, search string.
B. XML attributes, URI, name.
C. Label, URI, post arguments.
D. URI, search string, time range picker.
C
125
```
Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?
A. Access
B. Accounting
C. Authorization
D. Authentication
```
D
