SPLK-1002 sample questions

Question 1

What is the correct syntax to search for a tag associated with a value on a specific field?

Accepted Answer

tag:: =

Answer

tag=

Answer

tag= ( )

Answer

tag= ::

Question 2

What are the two parts of a root event dataset?

Accepted Answer

Constraints and fields.

Answer

Fields and variables.

Answer

Fields and attributes.

Answer

Constraints and lookups.

Question 3

When using| timechart by host, which field is represented in the x-axis?

Accepted Answer

time

Answer

date

Answer

host

Answer

_time

Question 4

Given the macro definition below, what should be entered into the Name and Arguments fields to correctly configure the macro?

Accepted Answer

The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

Answer

The macro name is sessiontracker and the arguments are action, JESSIONI

Answer

The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

Answer

The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

Question 5

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.

Which field name appears in the results?

Accepted Answer

Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

Answer

Both will appear in the All Fields list, but only if the alias is specified in the search.

Answer

The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

Answer

The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Question 6

Which of the following statements would help a user choose between the transaction and stats commands?

Accepted Answer

There is a 1000 event limitation with the transaction command.

Answer

stats can only group events using IP addresses.

Answer

The transaction command is faster and more efficient.

Answer

Use stats when the events need to be viewed as a single correlated event.

Question 7

What do events in a transaction have in common?

Accepted Answer

All events in a transaction must be related by one or more fields.

Answer

All events in a transaction must have the same timestamp.

Answer

All events in a transaction must have the same sourcetype.

Answer

All events in a transaction must have the exact same set of fields.

Question 8

Which of the following statements about event types is true? (Choose all that apply.)

Accepted Answer

Event types can be tagged.

Accepted Answer

Event types categorize events based on a search.

Answer

Event types must include a time range.

Answer

Event types can be a useful method for capturing and sharing knowledge.

Question 9

A user wants to convert numeric field values to strings and also to sort on those values.

Which command should be used first, the eval or the sort?

Accepted Answer

Convert the numeric to a string with eval first, then sort.

Answer

it doesn't matter whether eval or sort is used first.

Answer

Use sort first, then convert the numeric to a string with eval.

Answer

You cannot use the sort command and the eval command on the same field.

Question 10

When_USing the Field Extractor (FX), which of the following delimiters will work? (Choose all that apply.)

Accepted Answer

Pipes

Accepted Answer

Spaces

Answer

Tabs

Answer

Colons

Free SPLK-1002 sample questions