Question 1

What are search macros?

Options :

A : Lookup definitions in lookup tables.

B : Reusable pieces of search processing language.

C : A method to normalize fields.

D : Categories of search results.

Answer: B

Question 2

What is the correct way to name a macro with two arguments?

Options :

A : us_sales2

B : us_sales(1,2)

C : us_sale,2

D : us_sales(2)

Answer: D

Question 3

When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Options :

A : Tabs

B : Pipes

C : Colons

D : Spaces

Answer: A,B,D

Question 4

Which of the following statements about tags is true?

Options :

A : Tags are case insensitive.

B : Tags are created at index time.

C : Tags can make your data more understandable.

D :

Answer: C

Question 5

Consider the following search: Index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Options :

A : index=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID

B : index=web sourcetype=access_combined JSESSIONID

C : index=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151

D : index-web sourcetype=access_combined I transaction JSESSIONID I search SD404K289O2F151

Answer: B

Free SPLK-1002 Mock Exam – Practice Online Confidently

Buying Options: