EMT Practice Test

1. Question Content...

---

Question1: What must be done in order to use a lookup table in Splunk?

Question2: How are events displayed after a search is executed?

Question3: What is the correct syntax to count the number of events containing a vendor_actionfield?

Question4: Which of the following represents the Splunk recommended naming convention for dashboards?

Question5: Which of the following searches will return results where fail, 400, and error exist in every event?

Question6: Which time range picker configuration would return real-time events for the past 30 seconds?

Question7: What must be done before an automatic lookup can be created? (select all that apply)

Question8: It is no possible for a single instance of Splunk to manage the input, parsing and indexing of machine data.

Question9: Which of the following is the recommended way to create multiple dashboards displaying data from the same search?

Question10: When looking at a statistics table, what is one way to drill down to see the underlying events?

Question11: What can be included in the All Fields option in the sidebar?

Question12: By default, all users have DELETE permission to ALL knowledge objects.

Question13: In automatic lookup definitions, the _____ fields are those that are not in the event data.

Question14: In the fields sidebar, which character denotes alphanumeric field values?

Question15: What is a suggested Splunk best practice for naming reports?

Question16: It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine.

Question17: By default, which of the following is a Selected Field?

Question18: This function of the stats command allows you to return the middle-most value of field X.

Question19: At index time, in which field does Splunk store the timestamp value?

Question20: The command shown here does witch of the following: Command: |outputlookup products.csv

Question21: By default search results are not returned in ________ order.

Question22: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question23: Which search string matches only events with the status_code of 4:4?

Question24: What is the primary use for the rare command1?

Question25: This clause is used to group the output of a stats command by a specific name.

Question26: Creating Data Models:
Object ATTRIBUTES do not define ___________.

Question27: Which search string returns a filed containing the number of matching events and names that field Event Count?

Question28: This search will return 20 results. SEARCH: error | top host limit = 20

Question29: What are the steps to schedule a report?

Question30: Which statement is true about Splunk alerts?

Question31: What does the rare command do?

Question32: Which of the following are not true about lookups? (Select all that apply.)

Question33: Which command is used to validate a lookup file?

Question34: When a search returns __________, you can view the results as a list.

Question35: Which is a primary function of the timeline located under the search bar?

Question36: Which of the following is the most efficient filter for running searches in Splunk?

Question37: When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

Question38: Clicking a SEGMENT on a chart, ________.

Question39: Lookups allow you to overwrite your raw event.

Question40: What is a primary function of a scheduled report?

Question41: How does Splunk determine which fields to extract from data?

Question42: Splunk Components:
Which of the following are responsible for reducing search results?

Question43: Which Boolean operator is implied between search terms, unless otherwise specified?