EMT Practice Test

1. Question Content...

---

Question1: Which of the following file formats can be extracted using a delimiter field extraction?

Question2: The fields sidebar does not show________. (Select all that apply.)

Question3: In which of the following scenarios is an event type more effective than a saved search?

Question4: Which of the following describes the Splunk Common Information Model (CIM) add-on?

Question5: When a search returns __________, you can view the results as a list.

Question6: What does the following search do?
index=condlog type=mysterymeat action=eaten I scats count as cornlog_count by us:

Question7: Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

Question8: This function of the stats command allows you to return the middle-most value of field X.

Question9: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question10: Selected fields are displayed ______each event in the search results.

Question11: Which of the following eval command function is valid?

Question12: If a search returns ____________ it can be viewed as a chart.

Question13: A space is an implied _____ in a search string.

Question14: What are the two parts of a root event dataset?

Question15: Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

Question16: Which of the following are valid options with the chart command ?(select all that apply)

Question17: Using the export function, you can export search results as __________.( Select all that apply)

Question18: When extracting fields, we may choose to use our own regular expressions

Question19: Which of the following commands will show the maximum bytes?

Question20: The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

Question21: What does the fillnull command replace null values with, it the value argument is not specified?

Question22: What will you learn from the results of the following search?
sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

Question23: When using a field value variable with a Workflow Action, which punctuation mark will escape the data

Question24: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question25: What do events in a transaction have In common?

Question26: A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Question27: Which of the following statements describe the search string below?
dacamodel Application_State All_Application_State search

Question28: Which of the following are required to create a POST workflow action?

Question29: This is what Splunk uses to categorize the data that is being indexed.

Question30: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?