SPLK-1001 V1

Lookups allow you to overwrite your raw event.A . TrueB . FalseView AnswerAnswer: A

When a search returns __________, you can view the results as a list.A . a list of eventsB . transactionsC . statistical valuesView AnswerAnswer: C

Which command is used to validate a lookup file?A . | lookup products.csvB . inputlookup products.csvC . I inputlookup products.csvD . | lookup definition products.csvView AnswerAnswer: C

What does the following specified time range do? earliest=-72h@h latest=@dA . Look back 3 days ago and priorB . Look back 72 hours up to one day agoC . Look back 72 hours, up to the end of todayD . Look back from 3 days ago up to the beginning...

By default, all users have DELETE permission to ALL knowledge objects.A . TrueB . FalseView AnswerAnswer: B

What can be included in the All Fields option in the sidebar?A . DashboardsB . Metadata onlyC . Non-interesting fieldsD . Field descriptionsView AnswerAnswer: C

When running searches command modifiers in the search string are displayed in what color?A . RedB . BlueC . OrangeD . HighlightedView AnswerAnswer: B

Which of the following is a best practice when writing a search string?A . Include all formatting commands before any search termsB . Include at least one function as this is a search requirementC . Include the search terms at the beginning of the search stringD . Avoid using formatting...

How do you add or remove fields from search results?A . Use field +to add and field -to remove.B . Use table +to add and table -to remove.C . Use fields +to add and fields Cto remove.D . Use fields Plus to add and fields Minus to remove.View AnswerAnswer: C

All users by default have WRITE permission to ALL knowledge objects.A . TrueB . FalseView AnswerAnswer: B