EMT Practice Test

1. Question Content...

---

Question1: When writing searches in Splunk, which of the following is true about Booleans?

Question2: What determines the scope of data that appears in a scheduled report?

Question3: In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?

Question4: Which of the following Splunk components typically resides on the machines where data originates?

Question5: Which search would return events from the access_combinedsourcetype?

Question6: When placed early in a search, which command is most effective at reducing search execution time?

Question7: When editing a dashboard, which of the following are possible options? (select all that apply)

Question8: How does Splunk determine which fields to extract from data?

Question9: How can search results be kept longer than 7 days?

Question10: A collection of items containing things such as data inputs, UI elements, and knowledge objects is known as what?

Question11: Which Boolean operator is always implied between two search terms, unless otherwise specified?

Question12: Which command is used to review the contents of a specified static lookup file?

Question13: By default, how long does Splunk retain a search job?

Question14: Which of the following file types is an option for exporting Splunk search results?

Question15: When an alert action is configured to run a script, Splunk must be able to locate the script. Which is one of the directories Splunk will look in to find the script?

Question16: Which of the following index searches would provide the most efficient search performance?

Question17: Which search string only returns events from hostWWW3?

Question18: What is the main requirement for creating visualizations using the Splunk UI?

Question19: What does the rarecommand do?

Question20: Which of the following is true about user account settings and preferences?

Question21: What is the correct syntax to count the number of events containing a vendor_actionfield?

Question22: When looking at a dashboard panel that is based on a report, which of the following is true?

Question23: Which of the following searches will return results where fail, 400, and error exist in every event?