EMT Practice Test

1. Question Content...

---

Question1: What does the fillnull command replace null values with, if the value argument is not specified?

Question2: Which of the following objects can a calculated field use as a source?

Question3: Which of the following describes the I transaction command?

Question4: How many ways are there to access the Field Extractor Utility?

Question5: The time range specified for a historical search defines the ____________ .------questionable on ans

Question6: Which one of the following statements about the search command is true?

Question7: Which of the following is true about Pivot?

Question8: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question9: When using the transaction command, what does the argument maxspan do?

Question10: What is the correct format for naming a macro with multiple arguments?

Question11: Which of the following eval command function is valid?

Question12: Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Question13: For choropleth maps,splunk ships with the following KMZ files (select all that apply)

Question14: Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

Question15: Which search would limit an "alert" tag to the "host" field?

Question16: Which of the following statements is true, especially in large environments?

Question17: When would transaction be used instead of stats?

Question18: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question19: When used with the timechart command, which value of the limit argument returns all values?

Question20: Which of the following statements describe GET workflow actions?

Question21: What is required for a macro to accept three arguments?

Question22: When should you use the transaction command instead of the scats command?

Question23: Which workflow action method can be used the action type is set to link?

Question24: When using a field value variable with a Workflow Action, which punctuation mark will escape the data

Question25: Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Question26: The eval command allows you to do which of the following? (Choose all that apply.)

Question27: Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Question28: Which of the following transforming commands can be used with transactions?
chart, timechart, stats, eventstats
chart, timechart, stats, diff
chart, timeehart, datamodel, pivot
chart, timecha:t, stats, pivot

Question29: What fields does the transaction command add to the raw events? (select all that apply)

Question30: Which statement is true?

Question31: Which type of visualization shows relationships between discrete values in three dimensions?

Question32: Calculated fields can be based on which of the following?

Question33: Which method in the Field Extractor would extract the port number from the following event? |
10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin <web error>

Question34: Which workflow action type performs a secondary search?

Question35: Which function should you use with the transaction command to set the maximum total time between the earliest and latest events returned?

Question36: Which of the following commands support the same set of functions?

Question37: Which workflow uses field values to perform a secondary search?

Question38: This is what Splunk uses to categorize the data that is being indexed.

Question39: The stats command will create a _____________ by default.

Question40: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question41: A calculated field maybe based on which of the following?

Question42: These users can create global knowledge objects. (Select all that apply.)

Question43: Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Question44: What do events in a transaction have In common?

Question45: Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Question46: In what order arc the following knowledge objects/configurations applied?

Question47: If a search returns ____________ it can be viewed as a chart.

Question48: When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Question49: Which of the following examples would use a POST workflow action?

Question50: The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

Question51: Which of the following are valid options to speed up reports? (Select all the apply.)

Question52: When defining a macro, what are the required elements?

Question53: Which of the following statements best describes a macro?

Question54: What type of command is eval?

Question55: What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Question56: A user runs the following search:
index-X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother-f Which of the following table headers match the order this command creates?

Question57: What will you learn from the results of the following search?
sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

Question58: Which of the following about reports is/are true?

Question59: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question60: Which search string would only return results for an event type called success ful_purchases?

Question61: Which of the following statements describes POST workflow actions?

Question62: How are arguments defined within the macro search string?

Question63: The transaction command allows you to __________ events across multiple sources

Question64: Using the export function, you can export search results as __________.( Select all that apply)

Question65: When using timechart, how many fields can be listed after a by clause?

Question66: Use the dedup command to _____.

Question67: Which of the following data models are included in the Splunk Common Information Model (CIM) add-on? (select all that apply)

Question68: Where are the results of eval commands stored?

Question69: Which of the following statements describe data model acceleration? (select all that apply)

Question70: Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Question71: Which of the following statements about event types is true? (select all that apply)

Question72: What are the two parts of a root event dataset?

Question73: Which of the following expressions could be used to create a calculated field called gigabytes?

Question74: Which of the following are required to create a POST workflow action?

Question75: Which of the following searches will show the number of categoryld used by each host?

Question76: When using | timechart by host, which field is represented in the x-axis?

Question77: Which of these search strings is NOT valid:

Question78: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question79: Which are valid ways to create an event type? (select all that apply)

Question80: Complete the search, .... | _____ failure>successes

Question81: Which of the following statements describes the use of the Filed Extractor (FX)?

Question82: When should the regular expression mode of Field Extractor (FX) be used? (select all that apply)

Question83: When creating a Search workflow action, which field is required?

Question84: Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Question85: Which of the following searches would return a report of sales by product-name?

Question86: A data model can consist of what three types of datasets?

Question87: What is the correct way to name a macro with two arguments?

Question88: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Question89: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question90: A data model consists of which three types of datasets?

Question91: Which of the following searches show a valid use of macro? (Select all that apply)

Question92: What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

Question93: What are search macros?

Question94: A calculated field is a shortcut for performing repetitive, long, or complex transformations using which of the following commands?

Question95: We can use the rename command to _____ (Select all that apply.)

Question96: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question97: Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?
| where 10yearAnnerversary=Renewal-MonthYear
| where '10yearAnnerversary=Renewal-MonthYear
| where 10yearAnnerversary='Renewal-MonthYear'
| where '10yearAnnerversary'='Renewal-MonthYear'

Question98: Which of the following is true about the Splunk Common Information Model (CIM)?

Question99: which of the following commands are used when creating visualizations(select all that apply.)

Question100: What does the fillnull command replace null values with, it the value argument is not specified?

Question101: Consider the following search:
index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group.
From the following list, which search groups events by JSESSIONID?

Question102: Which command is used to create choropleth maps?

Question103: These kinds of charts represent a series in a single bar with multiple sections

Question104: How is a Search Workflow Action configured to run at the same time range as the original search?

Question105: What are the expected results for a search that contains the command | where A=B?

Question106: Information needed to create a GET workflow action includes which of the following? (select all that apply.)

Question107: Which of the following knowledge objects represents the output of an eval expression?

Question108: This clause is used to group the output of a stats command by a specific name.

Question109: Which tool uses data models to generate reports and dashboard panels without using SPL?

Question110: Which of the following searches will return all clientip addresses that start with 108?