EMT Practice Test

1. Question Content...

---

Question1: These kinds of charts represent a series in a single bar with multiple sections

Question2: Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID

Question3: A data model consists of which three types of datasets?

Question4: Which of the following statements describes macros?

Question5: When should transaction be used?

Question6: This search user!=*_________________.

Question7: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question8: When using timechart, how many fields can be listed after a byclause?

Question9: Data model are composed of one or more of which of the fo-owing datasets? (select all that apply.)

Question10: What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Question11: In what order are the following knowledge objects/configurations applied?

Question12: Which of the following searches would return a report of sales by product-name?

Question13: Which of the following statements about event types is true? (select all that apply)

Question14: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question15: Selected fields are displayed ______each event in the search results.

Question16: Which of the following commands support the same set of functions?

Question17: Calculated fields can be based on which of the following?

Question18: Data model are composed of one or more of which of the following datasets? (select all that apply.)

Question19: Which of the following are not true about lookups? (Select all that apply.)

Question20: After manually editing; a regular expression (regex), which of the following statements is true?

Question21: Fast, optimized and verbose are all selectable search modes.

Question22: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question23: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question24: The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

Question25: What is the correct syntax to search for a tag associated with a value on a specific fields?

Question26: Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Question27: There are several ways to access the field extractor.
Which option automatically identifies the data type, source type, and sample event?

Question28: What is the correct order of steps for creating a new lookup?
1. Configure the lookup to run automatically
2. Create the lookup table
3. Define the lookup

Question29: Which Knowledge Object does the Splunk Common Information Model (CIM) use to normalize data, in addition to field aliases, event types, and tags?

Question30: When should transaction be used?

Question31: These kinds of fields are identified in your data at INDEX time. ----ans ?able

Question32: Which of the following describes the Splunk Common Information Model (CIM) add-on?

Question33: Which of the following can be used with the eval command tostring function (select all that apply)

Question34: Which of the following statements describes the command below (select all that apply) sourcetype-access_combined | transaction JSESSIONID

Question35: Creating Data Models:
Object ATTRIBUTES do not define ___________.

Question36: Using the export function, you can export a maximum of 2000 results.

Question37: When using the transaction command, what does the argument maxspan do?

Question38: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question39: Which command is used to create choropleth maps?

Question40: Which of the following statements describes POST workflow actions?

Question41: Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

Question42: Which of the following searches show a valid use of a macro? (Choose all that apply.) index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time

Question43: Which workflow uses field values to perform a secondary search?

Question44: When using timechart, how many fields can be listed after a byclause?

Question45: Which one of the following statements about the searchcommand is true?

Question46: To identify all of the contributing events within a transaction that contain at least one REJECTevent, which syntax is correct?

Question47: What is the relationship between data models and pivots?

Question48: What is the relationship between data models and pivots?

Question49: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question50: Which of the following can be used with the eval command tostring function (select all that apply)

Question51: Which of the following search control will not re-rerun the search? (Select all that apply.)

Question52: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question53: In which of the following scenarios is an event type more effective than a saved search?

Question54: What does the following search do?

Question55: This tab shows you the event patterns in the results of a specific search.

Question56: When using the transaction command, what does the argument maxspan do?

Question57: What will you learn from the results of the following search?
sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

Question58: Reports _____ allowing drilldown by default.

Question59: Which of the following statements is true, especially in largo environments?

Question60: This is what Splunk uses to categorize the data that is being indexed.

Question61: When you run a search, fast mode extracts all fields very quickly

Question62: How many ways are there to access the Field Extractor Utility?

Question63: When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

Question64: Which of the following Statements about macros is true? (select all that apply)

Question65: In what order arc the following knowledge objects/configurations applied?

Question66: If a search returns ____________ it can be viewed as a chart.

Question67: During the validation step of the Field Extractor workflow:
Select your answer.

Question68: What does the following search do?

Question69: What are the two parts of a root event dataset?

Question70: Which of the following statements describe GET workflow actions?

Question71: Which search would limit an "alert" tag to the "host" field?

Question72: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

Question73: The eval command allows you to do which of the following? (Choose all that apply.)

Question74: Which of the following Statements about macros is true? (select all that apply)

Question75: What are the two parts of a root event dataset?

Question76: When using | timechart by host, which field is represented in the x-axis?

Question77: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question78: Which one of the following statements about the searchcommand is true?

Question79: Which of the following searches would create a graph similar to the one below?

Question80: Which of the following can be used with the eval command tostring function (select all that apply)

Question81: This role is required to install the CIM Add-on.
Select your answer.

Question82: The limit attribute will___________.

Question83: Which of the following searches would return a report of sales by product-name?

Question84: Which of the following statements describe the search string below?
dacamodel Application_State All_Application_State search

Question85: In what order arc the following knowledge objects/configurations applied?

Question86: What is the correct way to name a macro with two arguments?

Question87: Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

Question88: A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

Question89: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question90: When using | timechart by host, which field is represented in the x-axis?

Question91: Which command can include both an over and a by clause to divide results into sub-groupings?

Question92: Which of the following statements about event types is true? (select all that apply)

Question93: When should you use the transaction command instead of the scats command?

Question94: __________ datasets can be added to root dataset to narrow down the search

Question95: Select this in the fields sidebar to automatically pipe you search results to the rare command

Question96: Which of the following searches would create a graph similar to the one below?

index=_internal sourcetype=SavedSplunker | fields sourcetype, status |

Question97: When should you use the transaction command instead of the scats command?

Question98: These are the default selected fields.

Question99: Which of the following Statements about macros is true? (select all that apply)

Question100: Which of the following statements describes calculated fields?

Question101: Data models are composed of one or more of which of the following datasets? (Choose all that apply.)

Question102: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question103: Which of the following statements are true for this search? (Select all that apply.) SEARCH:
sourcetype=access* |fields action productld status

Question104: When using timechart, how many fields can be listed after a by clause? ( Choose Two )

Question105: Which of the following statements about tags is true? (select all that apply.)

Question106: There is NOT a SAVE AS option when editing a report.

Question107: Where are the results of evalcommands stored?

Question108: Splunk alerts can be based on search that run______. (Select all that apply.)

Question109: Which of the following searches will return events containing a tag named Privileged?

Question110: Lookups allow you to overwrite your raw event.

Question111: Which of the following knowledge objects represents the output of an evalexpression?

Question112: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question113: Which of the following are valid options to speed up reports? (Select all the apply.)

Question114: What information must be included when using the datamodelcommand?

Question115: The timechart command buckets data in time intervals depending on:

Question116: This function of the stats command allows you to return the sample standard deviation of a field.

Question117: Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Question118: Which group of users would most likely use pivots?

Question119: Splunk Components:
Which of the following are responsible for parsing incoming data and storing data on disc?

Question120: Which of the following statements would help a user choose between the transactionand stats commands?

Question121: By default, all users have DELETE permission to ALL knowledge objects.

Question122: When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

Question123: This function of the stats command allows you to return the middle-most value of field X.

Question124: Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

Question125: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question126: These 2 searches will return exactly the same results:
SEARCH 1:host=www1 SEARCH 2: host=WWW1

Question127: Which of the following statements describe the Common Information Model (QM)? (select all that apply)

Question128: A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

Question129: Which of the following statements describes field aliases?

Question130: Which of the following searches show a valid use of macro? (Select all that apply)

Question131: The transaction command allows you to __________ events across multiple sources

Question132: Which one of the following statements about the search command is true?

Question133: Which of the following searches will show the number of categoryld used by each host?

Question134: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)

Question135: Which of the following statements describe GET workflow actions?

Question136: Which of the following searches will return events containing a tag named Privileged?

Question137: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question138: When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the requireoption is used?

Question139: Using the export function, you can export search results as __________.( Select all that apply)

Question140: Which of the following statements describes macros?