EMT Practice Test

1. Question Content...

---

Question1: By default, all users have DELETE permission to ALL knowledge objects.

Question2: which of the following are valid options with the chart command

Question3: Which of the following searches show a valid use of macro? (Select all that apply)

Question4: Which of the following searches would return a report of sales by product-name?

Question5: Which of the following searches would return a report of sales by product-name?

Question6: Which of the following are required to create a POST workflow action?

Question7: A data model consists of which three types of datasets?

Question8: Creating Data Models:
Fields associated with a data set are known as ______.

Question9: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question10: Which of the following eval command functions is valid?

Question11: Fast, optimized and verbose are all selectable search modes.

Question12: Which of the following searches will return events contains a tag name Privileged?

Question13: Which of the following statements describe the Common Information Model (CIM)? (Choose all that apply.)

Question14: When creating a Search workflow action, which field is required?

Question15: How does a user display a chart in stack mode?

Question16: There are several ways to access the field extractor.
Which option automatically identifies the data type, source type, and sample event?

Question17: Which of the following searches will return events contains a tag name Privileged?

Question18: When should transaction be used?

Question19: Search terms are not case sensitive.

Question20: This role is required to install the CIM Add-on.
Select your answer.

Question21: Using the export function, you can export search results as __________.( Select all that apply)

Question22: These two searches will NOT return the same results. SEARCH 1:login failure SEARCH 2: "login failure".

Question23: Which of the following statements describe calculated fields? (select all that apply)

Question24: Which of the following searches show a valid use of macro? (Select all that apply)

Question25: When is a GET workflow action needed?

Question26: New pivots automatically populate with __________ (Select all that apply).

Question27: A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

Question28: Data model are composed of one or more of which of the following datasets? (select all that apply.)

Question29: When can a pipe follow a macro?

Question30: Which of the following searches show a valid use of a macro? (Choose all that apply.) index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time

Question31: Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID

Question32: Which type of visualization shows relationships between discrete values in three dimensions?

Question33: What does the fillnull command replace null values with, it the value argument is not specified?

Question34: Which command can include both an over and a by clause to divide results into sub-groupings?

Question35: Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID

Question36: Which are valid ways to create an event type? (select all that apply)

Question37: Which of the following statements describe the Common Information Model (QM)? (select all that apply)

Question38: Which workflow action method can be used when the action type is set to link?

Question39: Which search mode returns all fields?

Question40: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question41: Which Knowledge Object does the Splunk Common Information Model (CIM) use to normalize data, in addition to field aliases, event types, and tags?

Question42: Which of the following can be used with the evalcommand tostringfunction? (Choose all that apply.)

Question43: The fields sidebar does not show________. (Select all that apply.)

Question44: Pivot visualizations____________.

Question45: Which group of users would most likely use pivots?

Question46: Historical searches provide a static snapshot of events at a given time.

Question47: These kinds of charts represent a series in a single bar with multiple sections

Question48: Which of the following are valid options with the chart command ?(select all that apply)

Question49: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

Question50: Which of the following eval command function is valid?

Question51: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

Question52: Which of the following statements is true, especially in largo environments?

Question53: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question54: What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Question55: Splunk Components:
Which of the following are responsible for parsing incoming data and storing data on disc?

Question56: What are the two parts of a root event dataset?

Question57: When using | timechart by host, which field is represented in the x-axis?

Question58: Field aliases are used to __________ data

Question59: What does the following search do?

Question60: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question61: What is a limitation of searches generated by workflow actions?

Question62: Internal fields, such as _raw and _time, can be explicitly removed from results with fields command.

Question63: Which workflow action method can be used the action type is set to link?

Question64: Which of the following can be used with the eval command tostring function (select all that apply)

Question65: When should transaction be used?

Question66: Which of the following statements describes field aliases?

Question67: Use the dedup command to _____.

Question68: Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

Question69: Which search mode automatically decides how to return fields based on your search?

Question70: Calculated fields can be based on which of the following?

Question71: Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Question72: Which of the following statements about event types is true? (select all that apply)

Question73: Which of the following knowledge objects represents the output of an evalexpression?

Question74: Field names are case ___________.

Question75: It is not possible for a single instance of Splunk to manage the input, parsing and indexing of machine.

Question76: Which of the following searches would return a report of sales by product-name?

Question77: Selected fields are displayed ______each event in the search results.

Question78: Which of the following statements about data models and pivot are true? (Choose all that apply.)

Question79: This function of the stats command allows you to return the middle-most value of field X.

Question80: All users by default have WRITE permission to ALL knowledge objects.

Question81: In the Field Extractor Utility, this button will display events that do not contain extracted fields.
Select your answer.

Question82: Which of the following statements describes calculated fields?

Question83: After manually editing; a regular expression (regex), which of the following statements is true?

Question84: When should transaction be used?

Question85: Only Splunk Administrators can assign selected fields.

Question86: These 2 searches will return exactly the same results:
SEARCH 1:host=www1 SEARCH 2: host=WWW1

Question87: When using the Field Extractor (FX), which of the following delimiters will work? (Choose all that apply.)

Question88: Which group of users would most likely use pivots?

Question89: When using | timechart by host, which field is represented in the x-axis?

Question90: Which of the following statements is true, especially in large environments?

Question91: Which of the following can be used with the evalcommand tostringfunction? (Choose all that apply.)

Question92: Creating Data Models:
Object ATTRIBUTES do not define ___________.

Question93: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question94: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question95: A calculated field maybe based on which of the following?

Question96: The timechart command buckets data in time intervals depending on:

Question97: Which of the following searches show a valid use of macro? (Select all that apply)

Question98: When using | timechart by host, which field is represented in the x-axis?

Question99: For choropleth maps,splunk ships with the following KMZ files (select all that apply)

Question100: In what order are the following knowledge objects/configurations applied?

Question101: Clicking a SEGMENT on a chart, ________.

Question102: Which of the following are required to create a POST workflow action?

Question103: Which of the following can be used with the eval command tostring function (select all that apply)

Question104: What is required for a macro to accept three arguments?

Question105: The eval command 'if' function requires the following three arguments (in order):

Question106: These allow you to categorize events based on search terms.
Select your answer.

Question107: When using timechart, how many fields can be listed after a by clause? ( Choose Two )

Question108: Which statement is true?

Question109: Which of the following statements describes POST workflow actions?