SPLK-1002 Practice Exam Questions and Answers

A.  

Format values

B.  

Convert values

C.  

Perform calculations

D.  

Use conditional statements

A.  

index=web sourcetype=access_combined | highlight JSESSIONID | search SD470K92802F117

B.  

index=web sourcetype=access_combined | transaction JSESSIONID | search SD470K92802F117

C.  

index=web sourcetype=access_combined SD470K92802F117 | table JSESSIONID

D.  

index=web sourcetype=access_combined JSESSIONID

A.  

chart sales by product_name

B.  

chart sum(price) as sales by product_name

C.  

stats sum(price) as sales over product_name

D.  

timechart list(sales), values(product_name)

A.  

There is a limit to the number of fields that can be extracted.

B.  

The user is unable to preview the extractions.

C.  

The extraction is added at index time.

D.  

The user is unable to return to the automatic field extraction workflow.

A.  

interesting fields

B.  

selected fields

C.  

all extracted fields

A.  

Şarg$

B.  

'arg'

C.  

%arg%

D.  

"arg"

A.  

An accelerated data model can be edited once its .tsidx file has expired.

B.  

An accelerated data model can be edited from the Pivot tool.

C.  

The data model must be de-accelerated before edits can be made to its structure.

D.  

It cannot be edited. A new data model would need to be created.

A.  

Sourcetype definitions from the most popular technology vendors.

B.  

A set of pre-configured data models.

C.  

Scripted inputs to pre-align data with the CIM.

D.  

Dashboards to validate data quality.

A.  

Event type

B.  

Field alias

C.  

Field extraction

D.  

Tag

A.  

Rank

B.  

Weight

C.  

Priority

D.  

Precedence