SPLK-1001 Practice Test

SPLK-1001 Practice Test practice questions, page 8 of 9, with answer review and explanations.

Question 36

Which statement is true about Splunk alerts?

  1. Alerts are based on searches that are either run on a scheduled interval or in real-time.
  2. Alerts are based on searches and when triggered will only send an email notification.
  3. Alerts are based on searches and require cron to run on scheduled interval.
  4. Alerts are based on searches that are run exclusively as real-time.

Question 37

What is the purpose of using a by clause with the stats command?

  1. To group the results by one or more fields.
  2. To compute numerical statistics on each field.
  3. To specify how the values in a list are delimited.
  4. To partition the input data based on the split-by fields.

Question 38

How do you add or remove fields from search results?

  1. Use field +to add and field -to remove.
  2. Use table +to add and table -to remove.
  3. Use fields +to add and fields ג€"to remove.
  4. Use fields Plus to add and fields Minus to remove.

Question 39

A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?

  1. Click All Fields and select the field to add it to Selected Fields.
  2. Click Interesting Fields and select the field to add it to Selected Fields.
  3. Click Selected Fields and select the field to add it to Interesting Fields.
  4. This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.

Question 40

In the fields sidebar, which character denotes alphanumeric field values?

  1. #
  2. %
  3. a
  4. a#