Which of the following statements about event types is true? (select all that apply)
A. Event types can be tagged.
B. Event types must include a time range,
C. Event types categorize events based on a search.
D. Event types can be a useful method for capturing and sharing knowledge.
Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)
A. This is a valid search and will display a timechart of the average duration, of each transaction event.
B. This is a valid search and will display a stats table showing the maximum pause among transactions.
C. No results will be returned because the transaction command must include the startswith and endswith options.
D. No results will be returned because the transaction command must be the last command used in the search pipeline.
Which of the following statements describe calculated fields? (select all that apply)
A. Calculated fields can be used in the search bar.
B. Calculated fields can be based on an extracted field.
C. Calculated fields can only be applied to host and sourcetype.
D. Calculated fields are shortcuts for performing calculations using the eval command.
Which of the following file formats can be extracted using a delimiter field extraction?
A. CSV
B. PDF
C. XML
D. JSON
What is the correct syntax to search for a tag associated with a value on a specific fields?
A. Tag- B. Tag C. Tag= D. Tag::
What do events in a transaction have In common?
A. All events In a transaction must have the same timestamp.
B. All events in a transaction must have the same sourcetype.
C. All events in a transaction must have the exact same set of fields.
D. All events in a transaction must be related by one or more fields.
Which search would limit an "alert" tag to the "host" field?
A. tag=alert
B. host::tag::alert
C. tag==alert
D. tag::host=alert
Which of the following searches would return a report of sales by product-name?
A. chart sales by product_name
B. chart sum(price) as sales by product_name
C. stats sum(price) as sales over product_name
D. timechart list(sales), values(product_name)
Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?
A. Macros
B. Lookups
C. Workflow actions
D. Field extractions
Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.
A. inputlookup
B. lookup