SPLK-1002 Practice Exam Questions and Answers

A.  

Use the scats command when you next to group events by two or more fields.

B.  

The stats command is faster and more efficient than the transaction command

C.  

The transaction command is faster and more efficient than the stats command.

D.  

Use the transaction command when you want to see the results of a calculation.

A.  

Root events cannot be accelerated.

B.  

Accelerated data models cannot be edited.

C.  

Private data models cannot be accelerated.

D.  

You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model.

A.  

Fields and variables.

B.  

Fields and attributes.

C.  

Constraints and fields.

D.  

Constraints and lookups.

A.  

Tabs

B.  

Pipes

C.  

Colons

D.  

Spaces

A.  

below

B.  

interesting fields

C.  

other fields

D.  

above

A.  

Field alias names replace the original field name.

B.  

Field aliases can be used in lookup file definitions.

C.  

Field aliases only normalize data across sources and sourcetypes.

D.  

Field alias names are not case sensitive when used as part of a search.

A.  

GET workflow actions must be configured with POST arguments.

B.  

Configuration of GET workflow actions includes choosing a sourcetype.

C.  

Label names for GET workflow actions must include a field name surrounded by dollar signs.

D.  

GET workflow actions can be configured to open the URT link in the current window or in a new window

A.  

Evenrches would return a report of sales by state.

B.  

Events will be returned from the data model named Application_State.

C.  

Events will be returned from the data model named All_Application_state.

D.  

No events will be returned because the pipe should occur after the datamodel command

A.  

Remove fields from results.

B.  

Create or replace an existing field.

C.  

Group transactions by one or more fields.

D.  

Save SPL commands to be reused in other searches.

A.  

0

B.  

N/A

C.  

NaN

D.  

NULL