Question 1

When defining a macro, what are the required elements?

Options :

A : Name and arguments.

B : Name and a validation error message.

C : Name and definition.

D : Definition and arguments.

Answer: C

Question 2

What are the expected results for a search that contains the command | where A=B?

Options :

A : Events that contain the string value where A=B.

B : Events that contain the string value A=B.

C : Events where values of field are equal to values of field B.

D : Events where field A contains the string value B.

Answer: C

Question 3

A calculated field may be based on which of the following?

Options :

A : Fields generated within a search string

B : Lookup tables

C : Regular expressions

D : Extracted fields

Answer: D

Question 4

Which of the following can be used with the eval command tostring function (select all that apply)

Options :

A : ‘’hex’’

B : ‘’commas’’

C : ‘’Decimal’’

D : ‘’duration’’

Answer: A,B,D

Question 5

Which of the following is included with the Common Information Model (CIM) add-on?

Options :

A : Search macros

B : Event category tags

C : Workflow actions

D : tsidx files

Answer: B

Free SPLK-1002 Mock Exam – Practice Online Confidently