SPLK-1001 Practice Test

SPLK-1001 Practice Test practice questions, page 6 of 9, with answer review and explanations.

Question 26

What is the correct syntax to count the number of events containing a vendor_action field?

  1. count stats vendor_action
  2. count stats (vendor_action)
  3. stats count (vendor_action)
  4. stats vendor_action (count)

Question 27

What is one benefit of creating dashboard panels from reports?

  1. Any newly created dashboard will include that report.
  2. There are no benefits to creating dashboard panels from reports.
  3. It makes the dashboard more efficient because it only has to run one search string.
  4. Any change to the underlying report will affect every dashboard that utilizes that report.

Question 28

By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

  1. host
  2. index
  3. source
  4. sourcetype

Question 29

Which of the following statements about case sensitivity is true?

  1. Both field names and field values ARE case sensitive.
  2. Field names ARE case sensitive; field values are NOT.
  3. Field values ARE case sensitive; field names ARE NOT.
  4. Both field names and field values ARE NOT case sensitive.

Question 30

What does the rare command do?

  1. Returns the least common field values of a given field in the results.
  2. Returns the most common field values of a given field in the results.
  3. Returns the top 10 field values of a given field in the results.
  4. Returns the lowest 10 field values of a given field in the results.