EMT Practice Test

1. Question Content...

---

Question1: When using | timchart by host, which filed is representted in the x-axis?

Question2: The macro weekly sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?

Question3: Using the export function, you can export search results as __________.( Select all that apply)

Question4: The timechart command is an example of which of the following command types?

Question5: What is the correct way to name a macro with two arguments?

Question6: Which search retrieves events with the event type web_errors?

Question7: When would a user select delimited field extractions using the Field Extractor (FX)?

Question8: Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

Question9: Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Question10: The timechart command buckets data in time intervals depending on:

Question11: Why would the following search produce multiple transactions instead of one?

Question12: Which field will be used to populate the field if the productName and product:d fields have values for a given event?
| eval productINFO=coalesco(productName,productid)

Question13: What do events in a transaction have In common?

Question14: The transaction command allows you to __________ events across multiple sources

Question15: In what order arc the following knowledge objects/configurations applied?

Question16: Which of the following statements describes an event type?

Question17: This is what Splunk uses to categorize the data that is being indexed.

Question18: Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Question19: What is a limitation of searches generated by workflow actions?

Question20: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question21: By default search results are not returned in ________ order.

Question22: A data model consists of which three types of datasets?

Question23: What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Question24: Which of the following is included with the Common Information Model (CIM) add-on?

Question25: Which of the following is NOT a stats function:

Question26: A space is an implied _____ in a search string.

Question27: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question28: When is a GET workflow action needed?

Question29: Which of these is NOT a field that is automatically created with the transaction command?

Question30: which of the following are valid options with the chart command

Question31: When using the timechart command, how can a user group the events into buckets based on time?

Question32: When creating a Search workflow action, which field is required?

Question33: Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize data. in addition to field aliases, event types, and tags?

Question34: Which of the following file formats can be extracted using a delimiter field extraction?

Question35: The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

Question36: What are search macros?

Question37: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question38: Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

Question39: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question40: Which of the following about reports is/are true?

Question41: Which of the following statements are true for this search? (Select all that apply.) SEARCH:
sourcetype=access* |fields action productld status

Question42: Which of the following statements about tags is true? (select all that apply.)

Question43: Use the dedup command to _____.

Question44: Which of the following commands support the same set of functions?

Question45: Which method in the Field Extractor would extract the port number from the following event? |
10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin <web error>

Question46: What type of command is eval?

Question47: Which of the following workflow actions can be executed from search results? (select all that apply)

Question48: This clause is used to group the output of a stats command by a specific name.

Question49: Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Question50: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question51: Which of the following statements is true, especially in large environments?

Question52: The fields sidebar does not show________. (Select all that apply.)

Question53: Which of the following statements describes field aliases?

Question54: For choropleth maps,splunk ships with the following KMZ files (select all that apply)

Question55: Which command is used to create choropleth maps?

Question56: What is the correct syntax to search for a tag associated with a value on a specific fields?

Question57: A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

Question58: Which of the following searches will return events containing a tag named Privileged?

Question59: The stats command will create a _____________ by default.

Question60: Highlighted search terms indicate _________ search results in Splunk.

Question61: What information must be included when using the datamodel command?

Question62: The gauge command:

Question63: What are the expected results for a search that contains the command | where A=B?

Question64: Which are valid ways to create an event type? (select all that apply)

Question65: Which of the following is a feature of the Pivot tool?

Question66: What are the two parts of a root event dataset?

Question67: What is the relationship between data models and pivots?

Question68: __________ datasets can be added to root dataset to narrow down the search

Question69: Which search would limit an "alert" tag to the "host" field?

Question70: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question71: The eval command allows you to do which of the following? (Choose all that apply.)

Question72: A calculated field maybe based on which of the following?

Question73: Which of the following searches would create a graph similar to the one below?

Question74: Selected fields are displayed ______each event in the search results.

Question75: Which statement is true?

Question76: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)

Question77: The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

Question78: What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

Question79: Which of the following describes the I transaction command?

Question80: When should transaction be used?

Question81: Information needed to create a GET workflow action includes which of the following? (select all that apply.)

Question82: Which of the following statements describes the use of the Filed Extractor (FX)?

Question83: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question84: Which of the following can be used with the eval command tostring function (select all that apply)

Question85: which of the following commands are used when creating visualizations(select all that apply.)

Question86: Calculated fields can be based on which of the following?

Question87: Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Question88: This function of the stats command allows you to identify the number of values a field has.

Question89: What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Question90: Which of the following options will define the first event in a transaction?

Question91: Which field extraction method should be selected for comma-separated data?

Question92: How many ways are there to access the Field Extractor Utility?

Question93: Which of the following eval command functions is valid?

Question94: Which of the following statements about event types is true? (select all that apply)

Question95: Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

Question96: Where are the results of eval commands stored?

Question97: The time range specified for a historical search defines the ____________ .------questionable on ans

Question98: Which of the following statements about calculated fields in Splunk is true?