EMT Practice Test

1. Question Content...

---

Question1: Which Boolean operator is always implied between two search terms, unless otherwise specified?

Question2: When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?

Question3: What is the correct syntax to count the number of events containing a vendor_actionfield?

Question4: A collection of items containing things such as data inputs, UI elements, and knowledge objects is known as what?

Question5: At index time, in which field does Splunk store the timestamp value?

Question6: What type of search can be saved as a report?

Question7: Which stats command function provides a count of how many unique values exist for a given field in the result set?

Question8: Which of the following are not true about lookups? (Select all that apply.)

Question9: Which command is used to validate a lookup file?

Question10: How can search results be kept longer than 7 days?

Question11: Which of the following constraints can be used with the top command?

Question12: Which of the following are common constraints of the top command?

Question13: How can another user gain access to a saved report?

Question14: This clause is used to group the output of a stats command by a specific name.

Question15: Which search string is the most efficient?

Question16: When looking at a statistics table, what is one way to drill down to see the underlying events?

Question17: According to Splunk best practices, which placement of the wildcard results in the most efficient search?

Question18: This function of the stats command allows you to return the sample standard deviation of a field.

Question19: Creating Data Models:
Fields associated with a data set are known as ______.

Question20: All users by default have WRITE permission to ALL knowledge objects.

Question21: These users can create global knowledge objects. (Select all that apply.)

Question22: 36. Lookups can be private for a user.

Question23: Which Boolean operator is implied between search terms, unless otherwise specified?

Question24: Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

Question25: Which events will be returned by the following search string?
host=www3 status=503

Question26: This function of the stats command allows you to return the middle-most value of field X.

Question27: When placed early in a search, which command is most effective at reducing search execution time?

Question28: Which of the following describes lookup files?

Question29: Which of the following statements about case sensitivity is true?

Question30: Select the answer that displays the accurate placing of the pipe in the following search string:
index=security sourcetype=access_* status=200 stats count by price

Question31: What user interface component allows for time selection?

Question32: What syntax is used to link key/value pairs in search strings?

Question33: How are events displayed after a search is executed?

Question34: Which of the following are functions of the stats command?

Question35: When viewing the results of a search, what is an Interesting Field?

Question36: What determines the scope of data that appears in a scheduled report?

Question37: When looking at a dashboard panel that is based on a report, which of the following is true?

Question38: In the fields sidebar, what indicates that a field is numeric?

Question39: Which of the following is a Splunk search best practice?

Question40: It is no possible for a single instance of Splunk to manage the input, parsing and indexing of machine data.

Question41: Which of the following fields is stored with the events in the index?

Question42: What does the stats command do?

Question43: What does the following specified time range do?
earliest=-72h@h latest=@d

Question44: Splunk Components:
Which of the following are responsible for parsing incoming data and storing data on disc?

Question45: The stats command will create a _____________ by default.