SPLK-1004

SPLK-1004 practice questions, page 3 of 4, with answer review and explanations.

Question 11

What qualifies a report for acceleration?

  1. Fewer than 100k events in search results, with transforming commands used in the search string.
  2. More than 100k events in search results, with only a search command in the search string.
  3. More than 100k events in the search results, with a search and transforming command used in the search string.
  4. Fewer than 100k events in search results, with only a search and transaction command used in the search string.

Question 12

What happens to panels with post-processing searches when their base search is refreshed?

  1. The panels are deleted.
  2. The panels are only refreshed if they have also been configured.
  3. The panels are refreshed automatically.
  4. Nothing happens to the panels.

Question 13

How is a cascading input used?

  1. As part of a dashboard, but not in a form.
  2. Without token notation in the underlying XML.
  3. As a way to filter other input selections.
  4. As a default way to delete a user role.

Question 14

Which commands can run on both search heads and indexers?

  1. Transforming commands
  2. Centralized streaming commands
  3. Dataset processing commands
  4. Distributable streaming commands

Question 15

If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?

  1. Double tick marks around the nested macro.
  2. A comma before the nested macro.
  3. Square brackets around the nested macro.
  4. A pipe character before the nested macro.