EMT Practice Test

1. Question Content...

---

Question1: Which of the following are Splunk premium enhanced solutions? (Choose three.)

Question2: A collection of items containing things such as data inputs, UI elements, and knowledge objects is known as what?

Question3: This is what Splunk uses to categorize the data that is being indexed.

Question4: What options do you get after selecting timeline? (Choose four.)

Question5: When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?

Question6: What is the primary use for the rare command?

Question7: What is the proper SPL terminology for specifying a particular index in a search?

Question8: Which search would return events from the access_combined sourcetype?

Question9: What is a suggested Splunk best practice for naming reports?

Question10: When using the top command in the following search, which of the following will be true about the results?
index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count

Question11: The better way of writing search query for index is:

Question12: Parsing of data can happen both in HF and UF.

Question13: Which is a primary function of the timeline located under the search bar?

Question14: Machine data can be in structured and unstructured format.

Question15: Which of the following is a best practice when writing a search string?

Question16: Beginning parentheses is automatically highlighted to guide you on the presence of complimenting parentheses.

Question17: Zoom Out and Zoom to Selection re-executes the search.

Question18: The default host name used in Inputs general settings can not be changed.

Question19: When refining search results, what is the difference in the time picker between real-time and relative time ranges?

Question20: Which of the statements are correct? (Choose three.)

Question21: How are events displayed after a search is executed?

Question22: Log filtering/parsing can be done from _____________.

Question23: What does the stats command do?

Question24: What must be done in order to use a lookup table in Splunk?

Question25: Which of the following is an option after clicking an item in search results?

Question26: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question27: Which command is used to review the contents of a specified static lookup file?

Question28: Which statement is true about Splunk alerts?

Question29: How do you add or remove fields from search results?

Question30: By default, which role contains the minimum permissions required to have write access to Splunk alerts?

Question31: Which is not a comparison operator in Splunk

Question32: When viewing results of a search job from the Activity menu, which of the following is displayed?

Question33: Which of the following is true about user account settings and preferences?

Question34: It is no possible for a single instance of Splunk to manage the input, parsing and indexing of machine data.

Question35: Selected fields are a set of configurable fields displayed for each event.

Question36: What can be included in the All Fields option in the sidebar?

Question37: What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

Question38: Which of the following is the most efficient filter for running searches in Splunk?

Question39: Lookups allow you to overwrite your raw event.

Question40: By default search results are not returned in ________ order.

Question41: What is the primary use for the rare command1?

Question42: Monitor option in Add Data provides _______________.

Question43: Which of the following is an accurate definition of fields within Splunk?

Question44: Splunk internal fields contains general information about events and starts from underscore i.e. _ .

Question45: What user interface component allows for time selection?

Question46: Which statement is true about the top command?

Question47: You are able to create new Index in Data Input settings.

Question48: Which search will return only events containing the word "error" and display the results as a table that includes the fields named action, src, and dest?

Question49: How many minutes, by default, is the time to live (ttl) for an ad-hoc search job?

Question50: Keywords are highlighted when you mouse over search results and you can click this search result to (Choose three.):

Question51: Splunk index time process can be broken down into __________ phases.

Question52: Which of the following fields is stored with the events in the index?

Question53: In the fields sidebar, which character denotes alphanumeric field values?

Question54: Splunk Components:
Which of the following are responsible for reducing search results?

Question55: When saving a search directly to a dashboard panel instead of saving as a report first, which of the following is created?

Question56: This search will return 20 results. SEARCH: error | top host limit = 20

Question57: Which of the following reports is available in the Fields window?

Question58: Splunk users are assigned roles. Which of the following do roles determine?

Question59: Field names are case sensitive.

Question60: Which of the following searches will show the number of categoryld used by each host?

Question61: What is the default lifetime of every Splunk search job?

Question62: The four types of Lookups that Splunk provides out-of-the-box are External, KV Store, Geospatial and which of the following?

Question63: Which of the following is the best way to create a report that shows the last 24 hours of events?

Question64: The command shown here does witch of the following: Command: |outputlookup products.csv

Question65: What is a primary function of a scheduled report?

Question66: Which search string only returns events from hostWWW3?

Question67: Which of the following searches will return results where fail, 400, and error exist in every event?

Question68: Which stats command function provides a count of how many unique values exist for a given field in the result set?

Question69: How can another user gain access to a saved report?

Question70: Which of the following is a metadata field assigned to every event in Splunk?

Question71: Which command will rename action to Customer Action?

Question72: Which of the following is a Splunk internal field?

Question73: Universal forwarder is recommended for forwarding the logs to indexers.

Question74: This function of the stats command allows you to return the sample standard deviation of a field.

Question75: What type of search can be saved as a report?

Question76: What result will you get with following search index=test sourcetype="The_Questionnaire_P*" ?

Question77: There are three different search modes in Splunk (Choose three.):

Question78: When is the pipe character, I, used in search strings?

Question79: _______________ transforms raw data into events and distributes the results into an index.

Question80: Splunk Parses data into individual events, extracts time, and assigns metadata.

Question81: When placed early in a search, which command is most effective at reducing search execution time?

Question82: Matching of parentheses is a feature of Splunk Assistant.

Question83: What is the purpose of using a by clause with the stats command?

Question84: Given the following SPL search, how many rows of results would you expect to be returned by default?
index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip

Question85: When a search returns __________, you can view the results as a list.

Question86: What is a quick, comprehensive way to learn what data is present in a Splunk deployment?

Question87: When displaying results of a search, which of the following is true about line charts?

Question88: What is Splunk?

Question89: Fields are searchable name and value pairings that differentiates one event from another.

Question90: Which of the following Splunk components typically resides on the machines where data originates?

Question91: Which of the following constraints can be used with the top command?

Question92: Which command automatically returns percent and count columns when executing searches?

Question93: Which search matches the events containing the terms "error" and "fail"?

Question94: Field values are case sensitive.

Question95: What are the two most efficient search filters?

Question96: Which of the following statements are correct about Search & Reporting App? (Choose three.)

Question97: What is the correct order of steps for creating a new lookup?
1. Configure the lookup to run automatically
2. Create the lookup table
3. Define the lookup

Question98: Which of the following is a Splunk search best practice?

Question99: In the fields sidebar, what indicates that a field is numeric?

Question100: In automatic lookup definitions, the _____ fields are those that are not in the event data.

Question101: When looking at a statistics table, what is one way to drill down to see the underlying events?

Question102: At the time of searching the start time is 03:35:08.
Will it look back to 03:00:00 if we use -30m@h in searching?

Question103: Which of the following index searches would provide the most efficient search performance'?

Question104: Fields are searchable key value pairs in your event data.

Question105: Can you stop or pause the searching?

Question106: Which search will return the 15 least common field values for the dest_ip field?

Question107: NOT status = 100:

Question108: Which component of Splunk is primarily responsible for saving data?