EMT Practice Test

1. Question Content...

---

Question1: These kinds of charts represent a series in a single bar with multiple sections

Question2: Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Question3: When using | timchart by host, which filed is representted in the x-axis?

Question4: When extracting fields, we may choose to use our own regular expressions

Question5: When using a split series on a chart, the series MUST be displayed using the STACKED option.

Question6: Which of the following are valid options to speed up reports? (Select all the apply.)

Question7: Which of the following statements describe the Common Information Model (QM)? (select all that apply)

Question8: Which search would limit an "alert" tag to the "host" field?

Question9: A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Question10: The eval command 'if' function requires the following three arguments (in order):

Question11: Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Question12: This is what Splunk uses to categorize the data that is being indexed.

Question13: In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

Question14: Which of the following statements describe calculated fields? (select all that apply)

Question15: Which of the following statements describes POST workflow actions?

Question16: A real-time alert is ______________.

Question17: This tab shows you the event patterns in the results of a specific search.

Question18: Which of the following statements describes POST workflow actions?

Question19: The limit attribute will___________.

Question20: which of the following are valid options with the chart command

Question21: Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

Question22: Which of the following statements about tags is true? (select all that apply.)

Question23: Use the dedup command to _____.

Question24: Which statement is true?

Question25: Splunk alerts can be based on search that run______. (Select all that apply.)

Question26: The fields sidebar does not show________. (Select all that apply.)

Question27: Which of the following searches would create a graph similar to the one below?

Question28: __________ datasets can be added to root dataset to narrow down the search

Question29: Which of the following statements about tags is true?

Question30: A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

Question31: Which of the following searches show a valid use of macro? (Select all that apply)

Question32: Complete the search, .... | _____ failure>successes

Question33: This function of the stats command allows you to return the middle-most value of field X.

Question34: Which of the following statements describes macros?

Question35: In the Field Extractor Utility, this button will display events that do not contain extracted fields.
Select your answer.

Question36: Which of the following file formats can be extracted using a delimiter field extraction?

Question37: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question38: Which of the following searches will return events contains a tag name Privileged?

Question39: If a search returns ____________ it can be viewed as a chart.

Question40: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

Question41: When using timechart, how many fields can be listed after a by clause? ( Choose Two )

Question42: By default search results are not returned in ________ order.

Question43: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question44: A data model consists of which three types of datasets?

Question45: Information needed to create a GET workflow action includes which of the following? (select all that apply.)

Question46: By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Question47: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question48: Which workflow action method can be used the action type is set to link?

Question49: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question50: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question51: which of the following commands are used when creating visualizations(select all that apply.)

Question52: When can a pipe follow a macro?

Question53: Which of the following are required to create a POST workflow action?

Question54: Which is not a comparison operator in Splunk