Question 1

Assuming a standard time zone across the environment, what syntax will always return events from between 2: 00 AM and 5:00 AM?

Options :

A : datehour>-2 AND date_hour<5

B : earliest=-2h@h AND latest=-5h@h

C : time_hour>-2 AND time_hour>-5

D : earliest=2h@ AND latest=5h3h

Answer: B

Question 2

Which of the following is an event handler action?

Options :

A : Run an eval statement based on a user clicking a value on a form.

B : Set a token to select a value from the time range picker.

C : Pass a token from a drilldown to modify index settings.

D : Cancel all jobs based on the number of search job results captured.

Answer: A

Question 3

What is one way to troubleshoot dashboards?

Options :

A : Create an HTML panel using tokens to verify that they are set.

B : Run the | previous_searches command to your SPL queries.

C : Go to the Troubleshooting dashboard of the Searching and Reporting app.

D : Delete the dashboard and start over.

Answer: A

Question 4

Repeating JSON data structures within one event will be extracted as what type of fields?

Options :

A : Single value

B : Lexicographical

C : Multivalue

D : Mvindex

Answer: C

Question 5

Which of the following is true about themultikvcommand?

Options :

A : Themultikvcommand derives field names from the last column in a table-formatted event.

B : Themultikvcommand creates an event for each column in a table-formatted event.

C : Themultikvcommand requires field names to be ALL CAPS whenmultitable=false.

D : Themultikvcommand displays an event for each row in a table-formatted event.

Answer: D

Free SPLK-1004 Mock Exam – Practice Online Confidently