Question 1

Which of the following are potential string results returned by the typeof function?

Options :

A : True, False, Unknown

B : Number, String, Bool

C : Number, String, Null

D : Field, Value, Lookup

Answer: B

Question 2

What is one way to troubleshoot dashboards?

Options :

A : Create an HTML panel using tokens to verify that they are being set.

B : Delete the dashboard and start over.

C : Go to the Troubleshooting dashboard of the Searching and Reporting app.

D : Run the previous_searches command to troubleshoot your SPL queries.

Answer: A

Question 3

Which of the following is true about themultikvcommand?

Options :

A : Themultikvcommand derives field names from the last column in a table-formatted event.

B : Themultikvcommand creates an event for each column in a table-formatted event.

C : Themultikvcommand requires field names to be ALL CAPS whenmultitable=false.

D : Themultikvcommand displays an event for each row in a table-formatted event.

Answer: D

Question 4

Which of the following could be used to build a contextual drilldown?

Options :

A :

B : $earliest$and$latest$tokens set by a global time range picker.

C :

D :

Answer: A

Question 5

What does it mean when a command is run and the is_exact column is 0?

Options :

A : The distinct count of values for that field is exactly 0.

B : The distinct count of fields in the field summary is 1.

C : The distinct count of values in that field is approximated.

D : The distinct count of values for that field is exact.

Answer: C

Free SPLK-1004 Mock Exam – Practice Online Confidently