EMT Practice Test

1. Question Content...

---

Question1: Which of the following statements describes Search workflow actions?

Question2: For the following search, which field populates the x-axis?
index=security sourcetype=linux secure | timechart count by action

Question3: Which of the following statements describe GET workflow actions?

Question4: Which of the following statements describe data model acceleration? (select all that apply)

Question5: The timechart command buckets data in time intervals depending on:

Question6: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question7: Which of the following about reports is/are true?

Question8: Which of the following expressions could be used to create a calculated field called gigabytes?

Question9: In which Settings section are macros defined?

Question10: The stats command will create a _____________ by default.

Question11: Which of the following statements is true about the root dataset of a data model?

Question12: Which of the following statements would help a user choose between the transaction and stats commands?

Question13: Which statement is true?

Question14: Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

Question15: Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Question16: Which of the following can be used with the eval command tostring function (select all that apply)

Question17: When creating an event type, which is allowed in the search string?

Question18: Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

Question19: A space is an implied _____ in a search string.

Question20: Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Question21: Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID

Question22: A macro has another macro nested within it, and this inner macro requires an argument. How can the user pass this argument into the SPL?

Question23: Which of the following eval command functions is valid?

Question24: Which of the following are required to create a POST workflow action?

Question25: When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

Question26: Consider the the following search run over a time range of last 7 days:
index=web sourcetype=access_conbined | timechart avg(bytes) by product_nane Which option is used to change the default time span so that results are grouped into 12 hour intervals?

Question27: Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Question28: Which of the following workflow actions can be executed from search results? (select all that apply)

Question29: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question30: Which of the following statements are true for this search? (Select all that apply.) SEARCH:
sourcetype=access* |fields action productld status

Question31: Which of the following Statements about macros is true? (select all that apply)

Question32: To which of the following can a field alias be applied?

Question33: Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?

Question34: Which of the following statements about event types is true? (select all that apply)

Question35: Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

Question36: Data model are composed of one or more of which of the following datasets? (select all that apply.)

Question37: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question38: Which syntax is used to represent an argument in a macro definition?

Question39: Select this in the fields sidebar to automatically pipe you search results to the rare command

Question40: When using | timechart by host, which field is represented in the x-axis?

Question41: Which of the following statements describes the use of the Field Extractor (FX)?

Question42: The time range specified for a historical search defines the ____________ .------questionable on ans

Question43: This is what Splunk uses to categorize the data that is being indexed.

Question44: Why would the following search produce multiple transactions instead of one?

Question45: When using the transaction command, how are evicted transactions identified?

Question46: Which command is used to create choropleth maps?

Question47: Which of the following knowledge objects represents the output of an eval expression?

Question48: This function of the stats command allows you to return the sample standard deviation of a field.

Question49: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Question50: Which tool uses data models to generate reports and dashboard panels without using SPL?

Question51: Which of the following statements about tags is true? (select all that apply.)

Question52: A data model can consist of what three types of datasets?

Question53: What is the correct syntax to find events associated with a tag?

Question54: Which of the following options will define the first event in a transaction?

Question55: These users can create global knowledge objects. (Select all that apply.)

Question56: Given the macro definition below, what should be entered into the Name and Arguments fileds to correctly configured the macro?

Question57: Which of the following searches will return events containing a tag named Privileged?

Question58: What fields does the transaction command add to the raw events? (select all that apply)

Question59: When using | timchart by host, which filed is representted in the x-axis?

Question60: If a search returns ____________ it can be viewed as a chart.

Question61: When creating a data model, which root dataset requires at least one constraint?

Question62: The limit attribute will___________.

Question63: Tags can reference which of the following knowledge objects?

Question64: Which of the following statements describes the use of the Filed Extractor (FX)?

Question65: Information needed to create a GET workflow action includes which of the following? (select all that apply.)

Question66: Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

Question67: If a calculated field has the same name as an extracted field, what happens to the extracted field?

Question68: which of the following are valid options with the chart command

Question69: Which of the following is NOT a stats function:

Question70: Use the dedup command to _____.

Question71: Which of the following statements describes an event type?

Question72: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question73: What is required for a macro to accept three arguments?

Question74: If there are fields in the data with values that are " " or empty but not null, which of the following would add a value?

Question75: In the Field Extractor Utility, this button will display events that do not contain extracted fields.
Select your answer.

Question76: What is the purpose of a calculated field?

Question77: Which field extraction method should be selected for comma-separated data?

Question78: Which statement is true?

Question79: Which of the following objects can a calculated field use as a source?

Question80: When does the CIM add-on apply preconfigured data models to the data?

Question81: Splunk alerts can be based on search that run______. (Select all that apply.)

Question82: The eval command allows you to do which of the following? (Choose all that apply.)

Question83: These kinds of charts represent a series in a single bar with multiple sections

Question84: Consider the following search:
index=web sourcetype=access_corabined
The log shows several events that share the same jsesszonid value (SD462K101O2F267). View the events as a group.
From the following list, which search groups events by jSSESSIONID?

Question85: How is an event type created from the search window? (select all that apply)

Question86: How are event types different from saved reports?

Question87: How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)

Question88: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question89: Which of the following statements describes POST workflow actions?

Question90: When creating a Search workflow action, which field is required?

Question91: What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

Question92: A POST workflow action will pass which types of arguments to an external website?

Question93: This function of the stats command allows you to identify the number of values a field has.

Question94: Which of the following statements about calculated fields in Splunk is true?

Question95: A user wants to create a workflow action that will retrieve a specific field value from an event and run a search in a new browser window in the user's Splunk instance. What kind of workflow action should they create?

Question96: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question97: Which of the following commands connects an additional table of data directly to the right side of the existing table?

Question98: When would a user select delimited field extractions using the Field Extractor (FX)?

Question99: Which of the following commands support the same set of functions?

Question100: A calculated field may be based on which of the following?

Question101: What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Question102: Which of the following statements is true, especially in large environments?

Question103: Which of the following is a function of the Splunk Common Information Model (CIM)?

Question104: When would transaction be used instead of stats?

Question105: Which of the following is included with the Splunk Common Information Model (CIM) Add-on?

Question106: In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

Question107: Which are valid ways to create an event type? (select all that apply)

Question108: Complete the search, .... | _____ failure>successes

Question109: What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Question110: How is a macro referenced in a search?

Question111: This clause is used to group the output of a stats command by a specific name.

Question112: Which of the following statements best describes a macro?

Question113: Which of the following are valid options to speed up reports? (Select all the apply.)

Question114: Which of the following knowledge objects can reference field aliases?