EMT Practice Test

1. Question Content...

---

Question1: There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

Question2: When creating a Search workflow action, which field is required?

Question3: Which of the following statements describes the use of the Filed Extractor (FX)?

Question4: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question5: Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

Question6: Use the dedup command to _____.

Question7: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question8: Which of the following searches will return events containing a tag named Privileged?

Question9: What is the relationship between data models and pivots?

Question10: What do events in a transaction have In common?

Question11: Which of the following is a feature of the Pivot tool?

Question12: which of the following commands are used when creating visualizations(select all that apply.)

Question13: Which of the following statements about event types is true? (select all that apply)

Question14: Which of the following statements describes POST workflow actions?

Question15: What are search macros?

Question16: Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Question17: When should you use the transaction command instead of the scats command?

Question18: Which of the following statements describe GET workflow actions?

Question19: The stats command will create a _____________ by default.

Question20: Which of the following describes the I transaction command?

Question21: Which of the following statements about data models and pivot are true? (select all that apply)

Question22: What fields does the transaction command add to the raw events? (select all that apply)

Question23: Which of the following statements about tags is true? (select all that apply.)

Question24: Which of the following statements about tags is true?

Question25: When is a GET workflow action needed?

Question26: The gauge command:

Question27: Which of the following statements about tags is true?

Question28: Which of the following statements describe calculated fields? (select all that apply)

Question29: When creating a data model, which root dataset requires at least one constraint?

Question30: Which of the following statements describes field aliases?

Question31: If a search returns ____________ it can be viewed as a chart.

Question32: Selected fields are displayed ______each event in the search results.

Question33: This clause is used to group the output of a stats command by a specific name.

Question34: Which command is used to create choropleth maps?

Question35: Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Question36: When should transaction be used?

Question37: The timechart command is an example of which of the following command types?

Question38: The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

Question39: These allow you to categorize events based on search terms.
Select your answer.

Question40: After manually editing; a regular expression (regex), which of the following statements is true?

Question41: Which of the following searches show a valid use of macro? (Select all that apply)

Question42: Which of the following statements describe data model acceleration? (select all that apply)

Question43: In the Field Extractor, when would the regular expression method be used?

Question44: When using timechart, how many fields can be listed after a by clause?

Question45: What are the two parts of a root event dataset?

Question46: Which of the following statements describes Search workflow actions?

Question47: Which group of users would most likely use pivots?

Question48: What is the correct format for naming a macro with multiple arguments?

Question49: What does the fillnull command replace null values with, it the value argument is not specified?

Question50: Which of the following searches show a valid use of a macro? (Choose all that apply.)

Question51: Which of the following statements describes macros?

Question52: Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Question53: How many ways are there to access the Field Extractor Utility?

Question54: Which statement is true?

Question55: Which of the following statements describes POST workflow actions?

Question56: We can use the rename command to _____ (Select all that apply.)

Question57: What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Question58: The eval command 'if' function requires the following three arguments (in order):

Question59: Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Question60: Which of the following search control will not re-rerun the search? (Select all that apply.)

Question61: In what order arc the following knowledge objects/configurations applied?

Question62: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question63: Which workflow uses field values to perform a secondary search?

Question64: This is what Splunk uses to categorize the data that is being indexed.

Question65: Which of the following statements describes the use of the Field Extractor (FX)?

Question66: The eval command allows you to do which of the following? (Choose all that apply.)

Question67: A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Question68: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question69: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question70: What information must be included when using the datamodel command?

Question71: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question72: What is the Splunk Common Information Model (CIM)?

Question73: Which field extraction method should be selected for comma-separated data?

Question74: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Question75: What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Question76: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

Question77: This function of the stats command allows you to identify the number of values a field has.

Question78: What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

Question79: Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

Question80: Complete the search, .... | _____ failure>successes

Question81: Which search string would only return results for an event type called success ful_purchases?