EMT Practice Test

1. Question Content...

---

Question1: Information needed to create a GET workflow action includes which of the following? (select all that apply.)

Question2: In which of the following scenarios is an event type more effective than a saved search?

Question3: Which of the following statements describe data model acceleration? (select all that apply)

Question4: What is the purpose of the fillnull command?

Question5: Data model are composed of one or more of which of the following datasets? (select all that apply.)

Question6: Which workflow action type performs a secondary search?

Question7: When can a pipe follow a macro?

Question8: A space is an implied _____ in a search string.

Question9: Which of the following statements about data models and pivot are true? (select all that apply)

Question10: Which of the following commands support the same set of functions?

Question11: If there are fields in the data with values that are " " or empty but not null, which of the following would add a value?

Question12: Which of the following searches would return a report of sales by product-name?

Question13: Which of the following knowledge objects can reference field aliases?

Question14: When a search returns __________, you can view the results as a list.

Question15: What fields does the transaction command add to the raw events? (select all that apply)

Question16: These allow you to categorize events based on search terms.
Select your answer.

Question17: Which of the following searches will return events containing a tag named Privileged?

Question18: Which of the following search control will not re-rerun the search? (Select all that apply.)

Question19: Which statement is true?

Question20: Which of these is NOT a field that is automatically created with the transaction command?

Question21: Which of the following examples would use a POST workflow action?

Question22: How are event types different from saved reports?

Question23: Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?

Question24: Which workflow action method can be used the action type is set to link?

Question25: Which of the following statements about calculated fields in Splunk is true?

Question26: The eval command 'if' function requires the following three arguments (in order):

Question27: Why would the following search produce multiple transactions instead of one?

Question28: The limit attribute will___________.

Question29: What is the Splunk Common Information Model (CIM)?

Question30: The macro weekly_sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?

Question31: What type of command is eval?

Question32: Which of the following is included with the Splunk Common Information Model (CIM) Add-on?

Question33: What does the following search do?

Question34: What information must be included when using the datamodel command?

Question35: When should you use the transaction command instead of the scats command?

Question36: Which of the following statements describes the use of the Filed Extractor (FX)?

Question37: Calculated fields can be based on which of the following?

Question38: A POST workflow action will pass which types of arguments to an external website?

Question39: Which of the following searches show a valid use of a macro? (Choose all that apply.)

Question40: When using a field value variable with a Workflow Action, which punctuation mark will escape the data

Question41: When using transaction, what is the default maximum span between events?

Question42: In which Settings section are macros defined?

Question43: When creating a data model, which root dataset requires at least one constraint?

Question44: Calculated fields can be based on which of the following?

Question45: Which of these search strings is NOT valid:

Question46: When using | timechart by host, which field is represented in the x-axis?

Question47: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question48: Which of the following actions can the eval command perform?

Question49: Which of the following is true about the Splunk Common Information Model (CIM)?

Question50: If a calculated field has the same name as an extracted field, what happens to the extracted field?

Question51: Where are the results of eval commands stored?

Question52: A user runs the following search:
index-X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother-f Which of the following table headers match the order this command creates?

Question53: How is a Search Workflow Action configured to run at the same time range as the original search?

Question54: When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

Question55: Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

Question56: Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?

Question57: What does the fillnull command replace null values with, if the value argument is not specified?

Question58: Which of the following statements best describes a macro?

Question59: What are the expected results for a search that contains the command | where A=B?

Question60: Which of the following transforming commands can be used with transactions?

Question61: Which field will be used to populate the field if the productName and product:d fields have values for a given event?
| eval productINFO=coalesco(productName,productid)

Question62: Which command can include both an over and a by clause to divide results into sub-groupings?

Question63: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)

Question64: Which command is used to create choropleth maps?

Question65: Which of the following statements describes macros?

Question66: which of the following are valid options with the chart command

Question67: Which of these stats commands will show the total bytes for each unique combination of page and server?

Question68: Which of the following statements is true about the root dataset of a data model?

Question69: What are search macros?

Question70: Which of the following are valid options to speed up reports? (Select all the apply.)

Question71: Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)

Question72: Which tool uses data models to generate reports and dashboard panels without using SPL?

Question73: A calculated field may be based on which of the following?

Question74: This is what Splunk uses to categorize the data that is being indexed.

Question75: How is a macro referenced in a search?

Question76: The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

Question77: We can use the rename command to _____ (Select all that apply.)

Question78: When would a user select delimited field extractions using the Field Extractor (FX)?

Question79: Which of the following statements about tags is true?

Question80: How can an existing accelerated data model be edited?

Question81: How does a user display a chart in stack mode?

Question82: Which of the following is true about a datamodel that has been accelerated?

Question83: By default search results are not returned in ________ order.

Question84: Which of the following statements describes this search?
sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

Question85: Which of the following statements describes POST workflow actions?

Question86: Which of the following statements describes calculated fields?

Question87: What does the fillnull command replace null values with, it the value argument is not specified?

Question88: Which of the following statements are true for this search? (Select all that apply.) SEARCH:
sourcetype=access* |fields action productld status

Question89: Which of the following expressions could be used to create a calculated field called gigabytes?

Question90: Data models are composed of one or more of which of the following datasets? (select all that apply)

Question91: When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Question92: What do events in a transaction have In common?

Question93: What is the correct format for naming a macro with multiple arguments?

Question94: Which of the following searches will return events contains a tag name Privileged?

Question95: What commands can be used to group events from one or more data sources?

Question96: What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Question97: Which of the following statements about tags is true? (select all that apply.)

Question98: Which field extraction method should be selected for comma-separated data?

Question99: Which of the following searches would create a graph similar to the one below?

Question100: Which of the following describes the Splunk Common Information Model (CIM) add-on?

Question101: Which of the following can be used with the eval command tostring function (select all that apply)

Question102: When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

Question103: The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

Question104: When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied.
(Select all that apply).

Question105: In what order arc the following knowledge objects/configurations applied?

Question106: How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)

Question107: Which of the following eval commands will provide a new value for host from src if it exists?

Question108: Which of the following options will define the first event in a transaction?

Question109: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question110: What is required for a macro to accept three arguments?

Question111: To which of the following can a field alias be applied?

Question112: Which of the following objects can a calculated field use as a source?

Question113: What does the transaction command do?

Question114: For choropleth maps,splunk ships with the following KMZ files (select all that apply)

Question115: Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

Question116: Which workflow action type performs a secondary search?

Question117: Given the following eval statement:
...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

Question118: Which of the following searches will return all clientip addresses that start with 108?

Question119: Which of the following statements would help a user choose between the transaction and stats commands?

Question120: In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

Question121: When using the timechart command, how can a user group the events into buckets based on time?

Question122: Which of the following statements describes Search workflow actions?

Question123: How are arguments defined within the macro search string?

Question124: A data model can consist of what three types of datasets?

Question125: Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Question126: A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Question127: Which of the following describes this search?
New Search
'third_party_outages(EMEA,-24h)'

Question128: Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Question129: What is the correct syntax to find events associated with a tag?

Question130: Which of the following statements about tags is true?

Question131: What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)