SPLK-1002

Which of the following file formats can be extracted using a delimiter field extraction?A . CSVB . PDFC . XMLD . JSONView AnswerAnswer: A

The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might...

Which of the following statements describes this search? sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)A . This is a valid search and will display a timechart of the average duration, of each transaction event.B . This is a valid search and will display a stats table showing the maximum...

How does a user display a chart in stack mode?A . By using the stack command.B . By turning on the Use Trellis Layout option.C . By changing Stack Mode in the Format menu.D . You cannot display a chart in stack mode, only a timechart.View AnswerAnswer: C

Which of the following statements is true, especially in large environments?A . Use the scats command when you next to group events by two or more fields.B . The stats command is faster and more efficient than the transaction commandC . The transaction command is faster and more efficient than...

Calculated fields can be based on which of the following?A . TagsB . Extracted fieldsC . Output fields for a lookupD . Fields generated from a search stringView AnswerAnswer: B Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields

What is the correct syntax to search for a tag associated with a value on a specific fields?A . Tag-<field?B . Tag<filed(tagname.)C . Tag=<filed>::<tagname>D . Tag::<filed>=<tagname>View AnswerAnswer: D Explanation: Reference: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/TagandaliasfieldvaluesinSplunkWeb

Which of the following statements describes macros?A . A macro is a reusable search string that must contain the full search.B . A macro is a reusable search string that must have a fixed time range.C . A macro Is a reusable search string that may have a flexible time...

Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONIDA . An additional filed named maxspan is created.B . An additional field named duration is created.C . An additional field named eventcount is created.D . Events with the same JSESSIONID will be grouped...

Which of the following searches show a valid use of macro? (Select all that apply)A . index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newFieldB . index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newFieldC . index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newFieldD . index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'"...