SPLK-1002 Practice Test

SPLK-1002 Practice Test practice questions, page 5 of 10, with answer review and explanations.

Question 21

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

  1. The regex can no longer be edited.
  2. The field being extracted will be required for all future events.
  3. The events without the required field will not display in searches.
  4. Only events with the required string will be included in the extraction.

Question 22

When using | timechart by host, which field is represented in the x-axis?

  1. date
  2. host
  3. time
  4. _time

Question 23

Which of the following is the correct way to use the datamodel command to search fields in the Web data model within the Web dataset?

  1. | datamodel Web Web search | fields Web*
  2. | search datamodel Web Web | fields Web*
  3. | datamodel Web Web fields | search Web*
  4. datamodel=Web | search Web | fields Web*

Question 24

Which of the following statements describe the command below? (Choose all that apply.) sourcetype=access_combined | transaction JSESSIONID

  1. An additional field named maxspan is created.
  2. An additional field named duration is created.
  3. An additional field named eventcount is created.
  4. Events with the same JSESSIONID will be grouped together into a single event.

Question 25

Which of the following searches will return events containing a tag named Privileged?

  1. tag=Priv
  2. tag=Priv*
  3. tag=priv*
  4. tag=privileged