EMT Practice Test

1. Question Content...

---

Question1: The fields sidebar does not show________. (Select all that apply.)

Question2: When would transaction be used instead of stats?

Question3: The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?

Question4: Complete the search, .... | _____ failure>successes

Question5: Consider the the following search run over a time range of last 7 days:
index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane Which option is used to change the default time span so that results are grouped into 12 hour intervals?

Question6: Which of the following eval commands will provide a new value for host from src if it exists?

Question7: Which of the following transforming commands can be used with transactions?

Question8: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question9: Which of the following file formats can be extracted using a delimiter field extraction?

Question10: How are event types different from saved reports?

Question11: Which of the following statements describes the use of the Filed Extractor (FX)?

Question12: The timechart command buckets data in time intervals depending on:

Question13: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question14: Which statement is true?

Question15: Which of the following commands support the same set of functions?

Question16: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)

Question17: Which field extraction method should be selected for comma-separated data?

Question18: What is a limitation of searches generated by workflow actions?

Question19: These kinds of charts represent a series in a single bar with multiple sections

Question20: A calculated field is a shortcut for performing repetitive, long, or complex transformations using which of the following commands?

Question21: Which of the following statements best describes a macro?

Question22: When extracting fields, we may choose to use our own regular expressions

Question23: When would transaction be used instead of stats?

Question24: Which workflow action method can be used the action type is set to link?

Question25: Which of these stats commands will show the total bytes for each unique combination of page and server?

Question26: What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

Question27: Which of the following is true about data model attributes?

Question28: Which of the following searches will return events contains a tag name Privileged?

Question29: Which of the following statements describes the use of the Field Extractor (FX)?

Question30: Which of the following searches will show the number of categoryld used by each host?

Question31: Which of the following statements about tags is true?

Question32: Which of the following statements are true for this search? (Select all that apply.) SEARCH:
sourcetype=access* |fields action productld status

Question33: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question34: Which of the following searches show a valid use of a macro? (Choose all that apply.)

Question35: Which of the following knowledge objects represents the output of an eval expression?

Question36: These allow you to categorize events based on search terms.
Select your answer.

Question37: Which of the following statements about event types is true? (select all that apply)

Question38: Calculated fields can be based on which of the following?

Question39: Which tool uses data models to generate reports and dashboard panels without using SPL?

Question40: This is what Splunk uses to categorize the data that is being indexed.

Question41: Which of the following is a feature of the Pivot tool?

Question42: which of the following commands are used when creating visualizations(select all that apply.)

Question43: When using timechart, how many fields can be listed after a by clause?

Question44: Where are the results of eval commands stored?

Question45: What are the two parts of a root event dataset?

Question46: Which of the following eval command functions is valid?

Question47: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question48: Which of the following statements describes POST workflow actions?

Question49: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question50: What fields does the transaction command add to the raw events? (select all that apply)

Question51: Which syntax is used to represent an argument in a macro definition?

Question52: Which of the following statements would help a user choose between the transaction and stats commands?

Question53: There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

Question54: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Question55: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question56: What is the correct format for naming a macro with multiple arguments?

Question57: which of the following are valid options with the chart command

Question58: A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Question59: How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)

Question60: Which of the following searches would return a report of sales by product-name?

Question61: By default search results are not returned in ________ order.

Question62: This function of the stats command allows you to identify the number of values a field has.

Question63: How is a Search Workflow Action configured to run at the same time range as the original search?

Question64: The gauge command:

Question65: Using the export function, you can export search results as __________.( Select all that apply)

Question66: Which of the following are required to create a POST workflow action?

Question67: What does the following search do?

Question68: Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

Question69: Which of the following commands will show the maximum bytes?

Question70: What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Question71: What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Question72: Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)

Question73: What does the transaction command do?

Question74: The macro weekly_sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?

Question75: Which statement is true?

Question76: When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

Question77: The eval command 'if' function requires the following three arguments (in order):

Question78: Which of these is NOT a field that is automatically created with the transaction command?

Question79: What information must be included when using the datamodel command?

Question80: How does a user display a chart in stack mode?

Question81: Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Question82: Which of the following knowledge objects can reference field aliases?

Question83: Which one of the following statements about the search command is true?

Question84: This function of the stats command allows you to return the middle-most value of field X.

Question85: Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

Question86: A space is an implied _____ in a search string.

Question87: If a search returns ____________ it can be viewed as a chart.

Question88: When is a GET workflow action needed?

Question89: Which of the following describes the I transaction command?

Question90: In the Field Extractor, when would the regular expression method be used?

Question91: When using the transaction command, what does the argument maxspan do?

Question92: When can a pipe follow a macro?

Question93: The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

Question94: What is the correct way to name a macro with two arguments?

Question95: Which search retrieves events with the event type web_errors?

Question96: Which is not a comparison operator in Splunk

Question97: What is the purpose of the fillnull command?

Question98: Which of the following statements describe GET workflow actions?

Question99: Which of the following statements describes macros?

Question100: Which of the following actions can the eval command perform?

Question101: Calculated fields can be based on which of the following?

Question102: Which type of visualization shows relationships between discrete values in three dimensions?

Question103: When using | timechart by host, which field is represented in the x-axis?

Question104: Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Question105: Which of the following examples would use a POST workflow action?

Question106: This is what Splunk uses to categorize the data that is being indexed.

Question107: Which of the following can be saved as an event type?

Question108: What do events in a transaction have In common?

Question109: Which of the following objects can a calculated field use as a source?

Question110: How is a macro referenced in a search?

Question111: Which of the following searches would create a graph similar to the one below?

Question112: By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Question113: Which of the following is true about Pivot?