EMT Practice Test

1. Question Content...

---

Question1: When displaying results of a search, which of the following is true about line charts?

Question2: How can search results be kept longer than 7 days?

Question3: Which command is used to validate a lookup file?

Question4: Which of the following are not true about lookups? (Select all that apply.)

Question5: 36. Lookups can be private for a user.

Question6: By default, all users have DELETE permission to ALL knowledge objects.

Question7: What syntax is used to link key/value pairs in search strings?

Question8: How do you add or remove fields from search results?

Question9: What is the purpose of using a by clause with the stats command?

Question10: What must be done in order to use a lookup table in Splunk?

Question11: When writing searches in Splunk, which of the following is true about Booleans?

Question12: Which Boolean operator is always implied between two search terms, unless otherwise specified?

Question13: Which of the following searches will show the number of categoryld used by each host?

Question14: Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

Question15: When sorting on multiple fields with the sort command, what delimiter can be used between the field names in the search?

Question16: Which statement is true about the top command?

Question17: Which of the following fields is stored with the events in the index?

Question18: Which of the following are functions of the stats command?

Question19: In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?

Question20: What is the main requirement for creating visualizations using the Splunk UI?

Question21: When placed early in a search, which command is most effective at reducing search execution time?

Question22: What must be done before an automatic lookup can be created? (select all that apply)

Question23: Which of the following constraints can be used with the top command?

Question24: What can be included in the All Fields option in the sidebar?

Question25: Which is a primary function of the timeline located under the search bar?

Question26: Creating Data Models:
Fields associated with a data set are known as ______.

Question27: Which statement is true about Splunk alerts?

Question28: What does the rare command do?

Question29: What can be configured using the Edit Job Settings menu?

Question30: What is one benefit of creating dashboard panels from reports?