Question 1

Which search would limit an "alert" tag to the "host" field?

Options :

A : tag=alert

B : host::tag::alert

C : tag==alert

D : tag::host=alert

Answer: D

Question 2

What does the transaction command do?

Options :

A : Groups a set of transactions based on time.

B : Creates a single event from a group of events.

C : Separates two events based on one or more values.

D : Returns the number of credit card transactions found in the event logs.

Answer: B

Question 3

Given the following eval statement: ... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2) Which of the following is the equivalent using fillnull?

Options :

A : ... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)

B : There is no equivalent expression using fillnull

C : ... | fillnull field1 | fillnull value="NO-VALUE" field2

D : ... | fillnull value=0 field1 | fillnull field2

Answer: D

Question 4

What does the following search do?

Options :

A : Creates a table of the total count of users and split by corndogs.

B : Creates a table of the total count of mysterymeat corndogs split by user

C : Creates a table with the count of all types of corndogs eaten split by user.

D : Creates a table that groups the total number of users by vegetarian corndogs.

Answer: B

Question 5

Which search retrieves events with the event type web_errors?

Options :

A : tag=web_errors

B : eventtype=web_errors

C : eventtype "web errors"

D : eventtype (web_errors)

Answer: B

Free SPLK-1002 Mock Exam – Practice Online Confidently

Buying Options: