SPLK-1004 Practice Questions

A.  

Panels powered by an inline search require a minimum of one form input.

B.  

Form inputs cannot impact panels using inline searches.

C.  

Adding a form input to a dashboard converts all panels to prebuilt panels.

D.  

A token in a search can be replaced by a form input value.

A.  

Use inline searches.

B.  

Use base searches.

C.  

Use accelerated data models.

D.  

Use scheduled reports.

A.  

datehour>-2 AND date_hour<5

B.  

earliest=-2h@h AND latest=-5h@h

C.  

time_hour>-2 AND time_hour>-5

D.  

earliest=2h@ AND latest=5h3h

A.  

The default value NULL until the minimum match threshold is reached.

B.  

The default match value until the minimum match threshold is reached.

C.  

The first match unless the time_field attribute is specified.

D.  

Only the first match.

A.  

where and search

B.  

fields and appendpipe

C.  

stats and xyseries

D.  

eval and eventstats

A.  

In the Dashboard Editor, while the search is running.

B.  

In the Search Job Inspector, after the search completes.

C.  

In the Search Job Inspector, while the search is running.

D.  

In the Dashboard Editor, after the search completes.

A.  

As part of a dashboard, but not in a form.

B.  

Without notation in the underlying XML.

C.  

As a way to filter other input selections.

D.  

As a default way to delete a user role.

A.  

Each collection must have at least 3 fields, one of which needs to match values of a field in your event data.

B.  

Each collection must have at least 2 fields, one of which needs to match values of a field in your event data.

C.  

Each collection must have at least 2 fields, none of which need to match values of a field in your event data.

D.  

Each collection must have at least 3 fields, none of which need to match values of a field in your event data.

A.  

mvfilter(isnotnull(X))

B.  

mvfilter(x, isnotnull)

C.  

where mvfilter(isnotnull(X))

D.  

eval new_field=mvfilter(*)

A.  

Applies only to accelerated data models.

B.  

When using an unaccelerated data model, the search produces a larger result count than withsummariesonly=f.

C.  

Applies only to unaccelerated data models.

D.  

When using an accelerated data model, the search produces a larger result count than withsummariesonly=f.