Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?
Which of the following statements describe calculated fields? (select all that apply)
Which of the following is NOT a stats function:
Which of the following statements describe the search below? (select all that apply)
Index=main I transaction clientip host maxspan=30s maxpause=5s
What is the relationship between data models and pivots?
Which of the following are required to create a POST workflow action?
Consider the the following search run over a time range of last 7 days:
index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane
Which option is used to change the default time span so that results are grouped into 12 hour intervals?
A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?
This is what Splunk uses to categorize the data that is being indexed.
The gauge command:
These kinds of charts represent a series in a single bar with multiple sections
Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?
Which is not a comparison operator in Splunk
Which search commands allow a user to access data model summaries?
What is needed to define a calculated field?
Which of the following is true about a datamodel that has been accelerated?
Consider the following search:
index=web sourcetype=access_corabined
The log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a group.
From the following list, which search groups events by jSSESSIONID?
Which of the following knowledge objects represents the output of an eval expression?
In what order arc the following knowledge objects/configurations applied?
When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?
Which one of the following statements about the search command is true?
For the following search, which field populates the x-axis?
index=security sourcetype=linux secure | timechart count by action
Which of the following statements is true, especially in large environments?
How many ways are there to access the Field Extractor Utility?
Complete the search, …. | _____ failure>successes
What is a benefit of installing the Splunk Common Information Model (CIM) add-on?
Select this in the fields sidebar to automatically pipe you search results to the rare command
There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?
Which of the following searches will return events containing a tag named Privileged?
Which of the following workflow actions can be executed from search results? (select all that apply)
The timechart command buckets data in time intervals depending on:
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
What are the expected search results from executing the following SPL command?
index=network NOT StatusCode=200
What is the correct format for naming a macro with multiple arguments?
The timechart command is an example of which of the following command types?
A data model can consist of what three types of datasets?
What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?
Which of the following statements describes the command below (select all that apply)
Sourcetype=access_combined | transaction JSESSIONID
Which of the following statements about tags is true? (select all that apply.)
By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?
Which of the following is true about data sets used in the Pivot tool?
It is mandatory for the lookup file to have this for an automatic lookup to work.
Why would the following search produce multiple transactions instead of one?
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search
Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?
Which of the following commands connects an additional table of data directly to the right side of the existing table?
When using timechart, how many fields can be listed after a by clause?
What do events in a transaction have In common?
Which syntax is used to represent an argument in a macro definition?
When creating a Search workflow action, which field is required?
The eval command allows you to do which of the following? (Choose all that apply.)
Which of the following transforming commands can be used with transactions?
A data model consists of which three types of datasets?
Which statement is true?
Which delimiters can the Field Extractor (FX) detect? (select all that apply)
Data models are composed of one or more of which of the following datasets? (select all that apply)
Which of the following statements describes the use of the Field Extractor (FX)?
Which of the following can a field alias be applied to?
When extracting fields, we may choose to use our own regular expressions
A Splunk app is configured to extract domain names in web service logs and specify them as a field named domain.
What workflow action would return an external IP lookup for the field named domain?
Which of the following statements describes POST workflow actions?
What is the purpose of a calculated field?
When using the transaction command, what is the assigned timestamp for each of the resulting transactions?
Which of these is NOT a field that is automatically created with the transaction command?
Which of the following searches would return a report of sales by product-name?
When would a user select delimited field extractions using the Field Extractor (FX)?
Which of the following describes the I transaction command?
When should you use the transaction command instead of the scats command?
This function of the stats command allows you to return the sample standard deviation of a field.
Which of the following Statements about macros is true? (select all that apply)
What information must be included when using the datamodel command?
When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?
Which of the following statements describes an event type?
Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?
When is a GET workflow action needed?
Which field will be used to populate the field if the productName and product:d fields have values for a given event?
| eval productINFO=coalesco(productName,productid)
The transaction command allows you to __________ events across multiple sources
What are the two parts of a root event dataset?
__________ datasets can be added to root dataset to narrow down the search
Which of the following options will define the first event in a transaction?
How are event types different from saved reports?
Which of the following definitions describes a macro named "samplemacro" that accepts two arguments?
What fields does the transaction command add to the raw events? (select all that apply)
Which workflow action type performs a secondary search?
Which of the following search control will not re-rerun the search? (Select all that apply.)
Selected fields are displayed ______each event in the search results.
This is what Splunk uses to categorize the data that is being indexed.
Which are valid ways to create an event type? (select all that apply)