EMT Practice Test

1. Question Content...

---

Question1: A data model consists of which three types of datasets?

Question2: Which of the following statements describes field aliases?

Question3: This search user!=*_________________.

Question4: When using a split series on a chart, the series MUST be displayed using the STACKED option.

Question5: What does the following search do?

Question6: Data models are composed of one or more of which of the following datasets? (Choose all that apply.)

Question7: What does the following search do?

Question8: Which of the following eval command functions is valid?

Question9: Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

Question10: Which of the following statements describe GET workflow actions?

Question11: Lookups allow you to overwrite your raw event.

Question12: Which of the following statements describe the Common Information Model (QM)? (select all that apply)

Question13: In what order arc the following knowledge objects/configurations applied?

Question14: What is the correct syntax to search for a tag associated with a value on a specific field?

Question15: Which of the following statements describes POST workflow actions?

Question16: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question17: How is a Search Workflow Action configured to run at the same time range as the original search?

Question18: Which workflow action method can be used when the action type is set to link?

Question19: When creating a Search workflow action, which field is required?

Question20: Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Question21: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question22: Which statement is true?

Question23: The time range specified for a historical search defines the ____________ .------questionable on ans

Question24: When using | timechart by host, which field is represented in the x-axis?

Question25: Which of the following can be used with the evalcommand tostringfunction? (Choose all that apply.)

Question26: Which of the following statements about data models and pivot are true? (Choose all that apply.)

Question27: We can use the rename command to _____ (Select all that apply.)

Question28: Selected fields are displayed ______each event in the search results.

Question29: Which group of users would most likely use pivots?

Question30: Which of the following knowledge objects represents the output of an oval expression?

Question31: Select this in the fields sidebar to automatically pipe you search results to the rare command

Question32: Which one of the following statements about the searchcommand is true?

Question33: When using| timechart by host, which field is represented in the x-axis?

Question34: The limit attribute will___________.

Question35: Which of the following searches would return a report of sales by product-name?

Question36: By default, all users have DELETE permission to ALL knowledge objects.

Question37: Data model are composed of one or more of which of the fo-owing datasets? (select all that apply.)

Question38: Which of the following are valid options with the chart command ?(select all that apply)

Question39: How does a user display a chart in stack mode?

Question40: What does the Splunk Common Information Model (CIM) add-on include? (Choose all that apply.)

Question41: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question42: In what order arc the following knowledge objects/configurations applied?

Question43: Which of the following statements describes macros?

Question44: Which of these search strings is NOT valid:

Question45: When using | timechart by host, which field is represented in the x-axis?

Question46: Which of the following can be used with the evalcommand tostringfunction? (Choose all that apply.)

Question47: A data model consists of which three types of datasets?

Question48: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question49: Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID

Question50: The timechart command buckets data in time intervals depending on:

Question51: Calculated fields can be based on which of the following?

Question52: The Splunk search language does not support wildcards.

Question53: Fast, optimized and verbose are all selectable search modes.

Question54: When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied. (Select all that apply).

Question55: Calculated fields can be based on which of the following?

Question56: Which of the following about reports is/are true?

Question57: Which of the following statements about event types is true? (Choose all that apply.)

Question58: When is a GET workflow action needed?

Question59: In which of the following scenarios is an event type more effective than a saved search?

Question60: Historical searches provide a static snapshot of events at a given time.

Question61: A calculated field maybe based on which of the following?

Question62: Which of the following is a function of the Splunk Common Information Model (CIM)?

Question63: Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Question64: Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

Question65: Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

Question66: Which of the following is NOT a stats function:

Question67: The eval command 'if' function requires the following three arguments (in order):

Question68: Which of the following searches would create a graph similar to the one below?

Question69: Which of the following statements describe GET workflow actions?

Question70: Which one of the following statements about the search command is true?

Question71: These are the default selected fields.

Question72: How many ways are there to access the Field Extractor Utility?

Question73: Using the export function, you can export search results as __________.( Select all that apply)

Question74: which of the following are valid options with the chart command

Question75: Which group of users would most likely use pivots?

Question76: Which of the following statements describe calculated fields? (select all that apply)

Question77: When should transaction be used?

Question78: When using a field value variable with a Workflow Action, which punctuation mark will escape the data

Question79: Which of the following searches will return events contains a tag name Privileged?

Question80: Which of the following searches show a valid use of a macro? (Choose all that apply.) index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time

Question81: The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization.
If another person in the organization runs the shared report and no results are returned, why might this be?
(Choose all that apply.)

Question82: A data model consists of which three types of datasets?

Question83: What is the relationship between data models and pivots?

Question84: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question85: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question86: What does the following search do?

Question87: The gauge command:

Question88: In what order arc the following knowledge objects/configurations applied?

Question89: How does a user display a chart in stack mode?

Question90: Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Question91: What do events in a transaction have In common?

Question92: The eval command allows you to do which of the following? (Choose all that apply.)

Question93: Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Question94: Which group of users would most likely use pivots?

Question95: When can a pipe follow a macro?

Question96: Which of the following searches will return events containing a tag named Privileged?

Question97: Which of the following statements describes macros?

Question98: When should transaction be used?

Question99: The pivot editor has a map visualization option.

Question100: Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Question101: What does the following search do?

Question102: This function of the stats command allows you to return the middle-most value of field X.

Question103: Which of the following searches would return a report of sales by product-name?

Question104: What are the two parts of a root event dataset?

Question105: What is the correct format for naming a macro with multiple arguments?

Question106: Which of the following statements describes the use of the Filed Extractor (FX)?

Question107: What is a limitation of searches generated by workflow actions?

Question108: The transaction command allows you to __________ events across multiple sources

Question109: Which one of the following statements about the search command is true?

Question110: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)

Question111: Which of the following statements would help a user choose between the transactionand stats commands?

Question112: Which of the following knowledge objects represents the output of an evalexpression?

Question113: Creating Data Models:
Fields associated with a data set are known as ______.

Question114: An alert does not have to trigger every time it generates search results.

Question115: What information must be included when using the datamodel command?

Question116: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question117: After manually editing a regular expression (regex), which of the following statements is true?

Question118: After manually editing; a regular expression (regex), which of the following statements is true?

Question119: Which of the following searches show a valid use of a macro? (Choose all that apply.)

Question120: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question121: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question122: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)

Question123: There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

Question124: Which command can include both an overand a byclause to divide results into sub-groupings?

Question125: When using timechart, how many fields can be listed after a byclause?

Question126: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question127: Which workflow uses field values to perform a secondary search?

Question128: Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Question129: Which of the following statements describes Search workflow actions?

Question130: Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)

Question131: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question132: Which of the following statements about tags is true?

Question133: Which workflow action method can be used the action type is set to link?

Question134: Which is not a comparison operator in Splunk

Question135: Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

Question136: When using the transaction command, what does the argument maxspan do?

Question137: What is the correct syntax to search for a tag associated with a value on a specific fiedsd?

Question138: When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Question139: In which of the following scenarios is an event type more effective than a saved search?

Question140: What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid,
icid | timechart avg(duration)

Question141: Clicking a SEGMENT on a chart, ________.

Question142: Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Question143: Data model are composed of one or more of which of the fo-owing datasets? (select all that apply.)

Question144: Which of the following are required to create a POST workflow action?

Question145: When using the transaction command, what does the argument maxspan do?