SPLK-1002 Practice Exam Questions and Answers

A.  

tag=Priv

B.  

tag=Priv*

C.  

tag=priv*

D.  

tag=privileged

A.  

Sets the maximum total time between events in a transaction.

B.  

Sets the maximum length of all events within a transaction.

C.  

Sets the maximum total time between the earliest and latest events in a transaction.

D.  

Sets the maximum length that any single event can reach to be included in the transaction.

A.  

Turned off

B.  

Turned on

C.  

Determined automatically based on the sourcetype.

D.  

Determined automatically based on the data source.

A.  

skipped or deferred

B.  

automatically accelerated

C.  

deleted

D.  

all of the above

A.  

You can remove values that aren't a match for the field you want to define

B.  

You can validate where the data originated from

C.  

You cannot modify the field extraction

A.  

In a field.

B.  

In an index.

C.  

In a KV Store.

D.  

In a database.

A.  

Transaction datasets

B.  

Events datasets

C.  

Search datasets

D.  

Any child of event, transaction, and search datasets

A.  

Tag= Priv

B.  

Tag= Pri*

C.  

Tag= Priv*

D.  

Tag= Privileged

A.  

Display as selected fields.

B.  

Sorted

C.  

Charted based on time

D.  

Matching

A.  

chart sales by product_name

B.  

chart sum(price) as sales by product_name

C.  

stats sum(price) as sales over product_name

D.  

timechart list(sales), values(product_name)