Question 1

How to make Interesting field into a selected field?

Options :

A : Click field in field sidebar -> click YES on the pop-up dialog on upper right side -> check now field should be visible in the list of selected fields.

B : Not possible.

C : Only CLI changes will enable it

D : Click Settings -> Find field option -> Drop down select field -> enable selected field -> check now field should be visible in the list of selected fields.

Answer: A

Question 2

How can search results be kept longer than 7 days?

Options :

A : By scheduling a report.

B : By creating a link to the job.

C : By changing the job settings.

D : By changing the time range picker to more than 7 days

Answer: A

Question 3

When viewing the results of a search, what is an Interesting Field?

Options :

A : A field that appears in any event

B : A field that appears in every event

C : A field that appears in the top 10 event

D : A field that appears in at least 20% of the events

Answer: D

Question 4

Which command automatically returns percent and count columns when executing searches?

Options :

A : top

B : stats

C : table

D : percent

Answer: A

Question 5

It is mandatory for the lookup file to have this for an automatic lookup to work.

Options :

A : Source type

B : At least five columns

C : Timestamp

D : Input filed

Answer: D

Free SPLK-1001 Mock Exam – Practice Online Confidently

Buying Options: