SPLK-1002 Practice Test

SPLK-1002 Practice Test practice questions, page 9 of 10, with answer review and explanations.

Question 41

When using timechart, how many fields can be listed after a by clause?

  1. 0, because timechart doesn't support using a by clause.
  2. 1, because _time is already implied as the x-axis.
  3. 2, because one field would represent the x-axis and the other would represent the y-axis.
  4. There is no limit specific to timechart.

Question 42

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

  1. Both will appear in the All Fields list, but only if the alias is specified in the search.
  2. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
  3. The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
  4. The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Question 43

Which of the following statements describes macros?

  1. A macro is a reusable search string that must contain the full search.
  2. A macro is a reusable search string that must have a fixed time range.
  3. A macro is a reusable search string that may have a flexible time range.
  4. A macro is a reusable search string that must contain only a portion of the search.

Question 44

In what order are the following knowledge objects/configurations applied?

  1. Field Aliases, Field Extractions, Lookups
  2. Field Extractions, Field Aliases, Lookups
  3. Field Extractions, Lookups, Field Aliases
  4. Lookups, Field Aliases, Field Extractions

Question 45

In which of the following scenarios is an event type more effective than a saved search?

  1. When a search should always include the same time range.
  2. When a search needs to be added to other users' dashboards.
  3. When the search string needs to be used in future searches.
  4. When formatting needs to be included with the search string.