Question 1

The fieldproductscontains a multivalued field containing the names of products. What is the result of the commandmvexpand products limit=?

Options :

A : Compressed values inproductswill be uncompressed.

B : Separate events will be created for each product inproducts.

C : productswill be converted from a single value field to a multivalue field.

D : All multivalue fields will be converted to single value fields.

Answer: B

Question 2

Which commands can run on both search heads and indexers?

Options :

A : Transforming commands

B : Centralized streaming commands

C : Dataset processing commands

D : Distributable streaming commands

Answer: D

Question 3

Which of the following is an event handler action?

Options :

A : Run an eval statement based on a user clicking a value on a form.

B : Set a token to select a value from the time range picker.

C : Pass a token from a drilldown to modify index settings.

D : Cancel all jobs based on the number of search job results captured.

Answer: A

Question 4

What is one way to troubleshoot dashboards?

Options :

A : Create an HTML panel using tokens to verify that they are being set.

B : Delete the dashboard and start over.

C : Go to the Troubleshooting dashboard of the Searching and Reporting app.

D : Run the previous_searches command to troubleshoot your SPL queries.

Answer: A

Question 5

What does it mean when a command is run and the is_exact column is 0?

Options :

A : The distinct count of values for that field is exactly 0.

B : The distinct count of fields in the field summary is 1.

C : The distinct count of values in that field is approximated.

D : The distinct count of values for that field is exact.

Answer: C

Free SPLK-1004 Mock Exam – Practice Online Confidently