EMT Practice Test

1. Question Content...

---

Question1: Which of the following constraints can be used with the top command?

Question2: A field exists in search results, but isn't being displayed in the fields sidebar.
How can it be added to the fields sidebar?

Question3: How to make Interesting field into a selected field?

Question4: Which of the following searches will return results where fail, 400, and error exist in every event?

Question5: Selected fields are a set of configurable fields displayed for each event.

Question6: Which of the following are Splunk premium enhanced solutions? (Choose three.)

Question7: Uploading local files though Upload options index the file only once.

Question8: In the fields sidebar, which character denotes alphanumeric field values?

Question9: Which of the following Splunk components typically resides on the machines where data originates?

Question10: You can change the App context in Input setting.

Question11: Which search matches the events containing the terms "error" and "fail"?

Question12: Which of the following represents the Splunk recommended naming convention for dashboards?

Question13: Which of the following is the recommended way to create multiple dashboards displaying data from the same search?

Question14: In automatic lookup definitions, the _____ fields are those that are not in the event data.

Question15: Which of the following is a correct way to limit search results to display the 5 most common values of a field?

Question16: Which search will return the 15 least common field values for the dest_ipfield?

Question17: Assuming a user has the capability to edit reports, which of the following are editable?

Question18: In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?

Question19: Where does Licensing meter happen?

Question20: What can be included in the All Fields option in the sidebar?

Question21: Which of the following constraints can be used with the topcommand?

Question22: When is the pipe character, I, used in search strings?

Question23: By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

Question24: When writing searches in Splunk, which of the following is true about Booleans?

Question25: Which statement is true about Splunk alerts?

Question26: Which of the following is a metadata field assigned to every event in Splunk?

Question27: Search Assistant is enabled by default in the SPL editor with compact settings.

Question28: Zoom Out and Zoom to Selection re-executes the search.

Question29: When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?

Question30: How many main user roles do you have in Splunk?

Question31: When a search returns __________, you can view the results as a list.

Question32: All components are installed and administered in Splunk Enterprise on-premise.

Question33: What does the rare command do?

Question34: In the Splunk interface, the list of alerts can be filtered based on which characteristics?

Question35: What are the two most efficient search filters?

Question36: Which stats command function provides a count of how many unique values exist for a given field in the result set?

Question37: You can view the search result in following format (Choose three.):

Question38: Which search matches the events containing the terms "error" and "fail"?

Question39: Which of the statements are correct? (Choose three.)

Question40: What will always appear in the Selected Fields list?

Question41: Which Boolean operator is implied between search terms, unless otherwise specified?

Question42: Which of the following fields is stored with the events in the index?

Question43: When running searches command modifiers in the search string are displayed in what color?

Question44: When running searches command modifiers in the search string are displayed in what color?

Question45: What type of search can be saved as a report?

Question46: Which of the following are functions of the stats command?

Question47: All users by default have WRITE permission to ALL knowledge objects.

Question48: Which search will return only events containing the word "error" and display the results as a table that includes the fields named action, src, and dest?

Question49: When viewing the results of a search, what is an Interesting Field?

Question50: After running a search, what effect does clicking and dragging across the timeline have?

Question51: Portal for Splunk apps can be accessed through www.splunkbase.com

Question52: Which of the following searches would return events with failure in index netfw or warn :r critical in index netops?

Question53: Which command is used to review the contents of a specified static lookup file?

Question54: The new data uploaded in Splunk are shown in ________________.

Question55: What is the correct syntax to count the number of events containing a vendor_actior field?

Question56: Select the correct option that applies to Index time processing (Choose three.).

Question57: Which statscommand function provides a count of how many unique values exist for a given field in the result set?

Question58: Splunk internal fields contains general information about events and starts from underscore i.e. _ .

Question59: Which of the following searches will show the number of categoryld used by each host?

Question60: According to Splunk best practices, which placement of the wildcard results in the most efficient search?

Question61: By default, how long does Splunk retain a search job?

Question62: Which of the following Splunk components typically resides on the machines where data originates?

Question63: Which Boolean operator is implied between search terms, unless otherwise specified?

Question64: Select the answer that displays the accurate placing of the pipe in the following search string:
index=security sourcetype=access_* status=200 stats count by price

Question65: This clause is used to group the output of a stats command by a specific name.

Question66: This function of the stats command allows you to return the sample standard deviation of a field.

Question67: It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine.

Question68: When editing a dashboard, which of the following are possible options? (select all that apply)

Question69: In the Search and Reporting app, which tab displays timecharts and bar charts?

Question70: The stats command will create a _____________ by default.

Question71: Which of the following are common constraints of the top command?

Question72: How are events displayed after a search is executed?

Question73: A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?

Question74: Which of the following is the most efficient filter for running searches in Splunk?

Question75: In the fields sidebar, which character denotes alphanumeric field values?

Question76: What does the stats command do?

Question77: Following are the time selection option while making search:
(Choose all that apply.)

Question78: Which command automatically returns percent and count columns when executing searches?

Question79: Fields are searchable name and value pairings that differentiates one event from another.

Question80: What does the following specified time range do?
earliest=-72h@h latest=@d

Question81: At index time, in which field does Splunk store the timestamp value?

Question82: When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?

Question83: Which of the following is an option after clicking an item in search results?

Question84: Put query into separate lines where | (Pipes) are used by selecting following options.

Question85: At the time of searching the start time is 03:35:08.
Will it look back to 03:00:00 if we use -30m@h in searching?

Question86: What is the primary use for the rarecommand?

Question87: What is the main requirement for creating visualizations using the Splunk UI?

Question88: What are the steps to schedule a report?

Question89: Which of the following describes lookup files?

Question90: Which search string returns a filed containing the number of matching events and names that field Event Count?

Question91: Documentations for Splunk can be found at docs.splunk.com

Question92: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question93: How does Splunk determine which fields to extract from data?

Question94: Which of the following file types is an option for exporting Splunk search results?

Question95: Which command is used to validate a lookup file?

Question96: Which search string matches only events with the status_code of 4:4?

Question97: Which of the following is the most efficient search?

Question98: When viewing the results of a search, what is an Interesting Field?

Question99: Which of the following describes lookup files?

Question100: When running searches command modifiers in the search string are displayed in what color?

Question101: Which command will rename action to Customer Action?

Question102: What are the three main Splunk components?

Question103: What must be done in order to use a lookup table in Splunk?

Question104: Which stats command function provides a count of how many unique values exist for a given field in the result set?

Question105: Which search string matches only events with the status_codeof 404?

Question106: The better way of writing search query for index is:

Question107: Put query into separate lines where | (Pipes) are used by selecting following options.

Question108: After running a search, what effect does clicking and dragging across the timeline have?

Question109: Which search would return events from the access_combinedsourcetype?

Question110: Beginning parentheses is automatically highlighted to guide you on the presence of complimenting parentheses.

Question111: Which Field/Value pair will return only events found in the index named security?

Question112: Which of the statements is correct regarding click and drag option in timeline?

Question113: By default, how long does Splunk retain a search job?

Question114: Matching search terms are highlighted.

Question115: Which search string is the most efficient?

Question116: When editing a dashboard which of the following are possible options? (select all that apply)

Question117: What is a primary function of a scheduled report?

Question118: Which of the following fields is stored with the events in the index?

Question119: Which of the following is true about user account settings and preferences?

Question120: When an alert action is configured to run a script, Splunk must be able to locate the script. Which is one of the directories Splunk will look in to find the script?

Question121: Which time range picker configuration would return real-time events for the past 30 seconds?

Question122: How can search results be kept longer than 7 days?

Question123: Which command is used to validate a lookup file?

Question124: By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

Question125: When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Question126: Which of the following index searches would provide the most efficient search performance'?

Question127: How does Splunk determine which fields to extract from data?

Question128: At index time, in which field does Splunk store the timestamp value?

Question129: What must be done in order to use a lookup table in Splunk?

Question130: Which of the following statements are correct about Search & Reporting App? (Choose three.)

Question131: Universal forwarder is recommended for forwarding the logs to indexers.

Question132: Splunk Parses data into individual events, extracts time, and assigns metadata.

Question133: Which of the following is a Splunk internal field?

Question134: Which of the following index searches would provide the most efficient search performance?

Question135: By default, all users have DELETE permission to ALL knowledge objects.

Question136: What determines the scope of data that appears in a scheduled report?

Question137: How can search results be kept longer than 7 days?

Question138: At index time, in which field does Splunk store the timestamp value?

Question139: Monitor option in Add Data provides _______________.

Question140: How are events displayed after a search is executed?