EMT Practice Test

1. Question Content...

---

Question1: What is the correct syntax to search for a tag associated with a value on a specific fields?

Question2: In the Field Extractor, when would the regular expression method be used?

Question3: A data model consists of which three types of datasets?

Question4: Consider the following search:
index=web sourcetype=access_corabined
The log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a
group.
From the following list, which search groups events by jSSESSIONID?

Question5: Clicking a SEGMENT on a chart, ________.

Question6: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question7: A macro has another macro nested within it, and this inner macro requires an argument. How can the user pass
this argument into the SPL?

Question8: The macro weekly_sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?

Question9: Which of the following expressions could be used to create a calculated field called gigabytes?

Question10: Using the export function, you can export search results as __________.( Select all that apply)

Question11: What is a limitation of searches generated by workflow actions?

Question12: When defining a macro, what are the required elements?

Question13: Which of the following describes the Splunk Common Information Model (CIM) add-on?

Question14: Which of the following statements describes the use of the Filed Extractor (FX)?

Question15: Which of the following searches will return all clientip addresses that start with 108?

Question16: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question17: This function of the stats command allows you to identify the number of values a field has.

Question18: Which of the following statements describes POST workflow actions?

Question19: What type of command is eval?

Question20: If a search returns ____________ it can be viewed as a chart.

Question21: Which workflow uses field values to perform a secondary search?

Question22: Which of the following can be used with the eval command tostring function (select all that apply)

Question23: Information needed to create a GET workflow action includes which of the following? (select all that apply.)

Question24: What will you learn from the results of the following search?
sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

Question25: What approach is recommended when using the Splunk Common Information Model (CIM) add-on to
normalize data?

Question26: During the validation step of the Field Extractor workflow:
Select your answer.

Question27: Which of the following is true about the Splunk Common Information Model (CIM)?

Question28: When using a field value variable with a Workflow Action, which punctuation mark will escape the data

Question29: To create a tag, which of the following conditions must be met by the user?

Question30: If there are fields in the data with values that are " " or empty but not null, which of the following would add a
value?

Question31: Which command can include both an over and a by clause to divide results into sub-groupings?

Question32: Which of the following is a function of the Splunk Common Information Model (CIM)?

Question33: Which of the following is the correct way to use the data model command to search field in the data model
within the web dataset?

Question34: The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?

Question35: Tags can reference which of the following knowledge objects?

Question36: What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with
different names?

Question37: What is required for a macro to accept three arguments?

Question38: Which of the following statements describes an event type?

Question39: In what order arc the following knowledge objects/configurations applied?

Question40: By default search results are not returned in ________ order.

Question41: Which field extraction method should be selected for comma-separated data?

Question42: What are search macros?

Question43: The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The
created report can then be shared with other people in the organization. If another person in the organization
runs the shared report and no results are returned, why might this be? (select all that apply)

Question44: After manually editing; a regular expression (regex), which of the following statements is true?

Question45: What do events in a transaction have In common?

Question46: What is the correct way to name a macro with two arguments?

Question47: Which of the following about reports is/are true?

Question48: To identify all of the contributing events within a transaction that contains at least one REJECT event, which
syntax is correct?

Question49: Which is not a comparison operator in Splunk

Question50: Which of the following is true about data model attributes?

Question51: When using the transaction command, how are evicted transactions identified?

Question52: Which of the following searches will return events contains a tag name Privileged?

Question53: Why would the following search produce multiple transactions instead of one?

Question54: Which function should you use with the transaction command to set the maximum total time between the
earliest and latest events returned?

Question55: The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

Question56: When would transaction be used instead of stats?

Question57: Which of the following search control will not re-rerun the search? (Select all that apply.)

Question58: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question59: What fields does the transaction command add to the raw events? (select all that apply)

Question60: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question61: Which of the following are valid options to speed up reports? (Select all the apply.)

Question62: Which of the following statements about tags is true?

Question63: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question64: Which of the following statements describe GET workflow actions?

Question65: Calculated fields can be based on which of the following?

Question66: Which of the following commands will show the maximum bytes?

Question67: What are the two parts of a root event dataset?

Question68: Which search would limit an "alert" tag to the "host" field?

Question69: Which search retrieves events with the event type web_errors?

Question70: Which of the following statements about calculated fields in Splunk is true?

Question71: Complete the search, .... | _____ failure>successes

Question72: Which of the following objects can a calculated field use as a source?

Question73: In which Settings section are macros defined?

Question74: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 |
chart count over host

Question75: If a calculated field has the same name as an extracted field, what happens to the extracted field?

Question76: When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied.
(Select all that apply).

Question77: How is a Search Workflow Action configured to run at the same time range as the original search?

Question78: which of the following are valid options with the chart command

Question79: Which of the following statements describes the use of the Field Extractor (FX)?

Question80: How is an event type created from the search window? (select all that apply)

Question81: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question82: Which of the following is one of the pre-configured data models included in the Splunk Common Information
Model (CIM) add-on?

Question83: Which of the following is a feature of the Pivot tool?

Question84: Use the dedup command to _____.

Question85: How many ways are there to access the Field Extractor Utility?

Question86: The timechart command buckets data in time intervals depending on:

Question87: These allow you to categorize events based on search terms.
Select your answer.

Question88: The timechart command is an example of which of the following command types?

Question89: How are event types different from saved reports?

Question90: which of the following commands are used when creating visualizations(select all that apply.)

Question91: Which of the following is included with the Common Information Model (CIM) add-on?

Question92: Which of the following statements describes POST workflow actions?

Question93: A space is an implied _____ in a search string.

Question94: Select this in the fields sidebar to automatically pipe you search results to the rare command

Question95: What commands can be used to group events from one or more data sources?

Question96: Which of the following is NOT a stats function:

Question97: Which of the following statements is true, especially in large environments?

Question98: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe
Auto-Extracted fields? (select all that apply)

Question99: Which tool uses data models to generate reports and dashboard panels without using SPL?

Question100: Which of the following describes this search?
New Search
'third_party_outages(EMEA,-24h)'

Question101: What is the Splunk Common Information Model (CIM)?

Question102: What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Question103: Which of the following statements describes macros?

Question104: What information must be included when using the datamodel command?

Question105: When should you use the transaction command instead of the scats command?

Question106: Which of the following searches would create a graph similar to the one below?

Question107: The timechart command buckets data in time intervals depending on:

Question108: Which of the following statements about tags is true? (select all that apply.)

Question109: Which of the following searches would return a report of sales by product-name?

Question110: The limit attribute will___________.

Question111: Which of the following statements describes calculated fields?

Question112: The time range specified for a historical search defines the ____________ .------questionable on ans

Question113: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question114: Which of the following describes the I transaction command?

Question115: By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Question116: When is a GET workflow action needed?