EMT Practice Test

1. Question Content...

---

Question1: Where are the results of eval commands stored?

Question2: A field alias is created where field1-fieid2 and the Overwrite Field Values checkbox is selected.
What happens if an event only contains values for fieid1?

Question3: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question4: During the validation step of the Field Extractor workflow:
Select your answer.

Question5: Field aliases are used to __________ data

Question6: Tags can reference which of the following knowledge objects?

Question7: This is what Splunk uses to categorize the data that is being indexed.

Question8: Complete the search, .... | _____ failure>successes

Question9: Which type of visualization shows relationships between discrete values in three dimensions?

Question10: Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID

Question11: Which of the following statements are true for this search? (Select all that apply.) SEARCH: sourcetype=access* |fields action productld status

Question12: What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

Question13: When using the transaction command, how are evicted transactions identified?

Question14: Which method in the Field Extractor would extract the port number from the following event? |
10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin <web error>

Question15: What is the relationship between data models and pivots?

Question16: Why are tags useful in Splunk?

Question17: This is what Splunk uses to categorize the data that is being indexed.

Question18: By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Question19: When should transaction be used?

Question20: Which of the following statements about calculated fields in Splunk is true?

Question21: When used with the timechart command, which value of the limit argument returns all values?

Question22: The transaction command allows you to __________ events across multiple sources

Question23: The stats command will create a _____________ by default.

Question24: These allow you to categorize events based on search terms.
Select your answer.

Question25: A calculated field is a shortcut for performing repetitive, long, or complex transformations using which of the following commands?

Question26: Given the following eval statement:
...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

Question27: How can an existing accelerated data model be edited?

Question28: Which of the following statements is true about the root dataset of a data model?

Question29: Which of the following are valid options to speed up reports? (Select all the apply.)

Question30: For the following search, which command would further filter for only IP addresses present more than five times?

Question31: Which statement is true?

Question32: When extracting fields, we may choose to use our own regular expressions

Question33: What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Question34: What type of command is eval?

Question35: Which of the following commands support the same set of functions?

Question36: A POST workflow action will pass which types of arguments to an external website?

Question37: Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)

Question38: Which of the following is included with the Common Information Model (CIM) add-on?

Question39: Which of the following searches can be used to define an event type?

Question40: After manually editing; a regular expression (regex), which of the following statements is true?

Question41: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question42: When a search returns __________, you can view the results as a list.

Question43: When creating a Search workflow action, which field is required?

Question44: In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

Question45: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question46: Which of the following search control will not re-rerun the search? (Select all that apply.)

Question47: Which of the following statements describes POST workflow actions?

Question48: When would a user select delimited field extractions using the Field Extractor (FX)?

Question49: Which of the following is included with the Splunk Common Information Model (CIM) Add-on?

Question50: Which of the following commands will show the maximum bytes?

Question51: Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

Question52: When using transaction, what is the default maximum span between events?

Question53: Which of the following Statements about macros is true? (select all that apply)

Question54: Which of the following statements describes macros?

Question55: The macro weekly sales (2) contains the search string:
index=games | eval ProductSales = $Price$ * $AmountSold$
Which of the following will return results?

Question56: Which of the following searches show a valid use of a macro? (Choose all that apply.)

Question57: Which of the following statements best describes a macro?

Question58: How do event types help a user search their data?

Question59: Which of the following options will define the first event in a transaction?

Question60: Which of these stats commands will show the total bytes for each unique combination of page and server?

Question61: Which tool uses data models to generate reports and dashboard panels without using SPL?

Question62: In the Field Extractor, when would the regular expression method be used?

Question63: What is the correct syntax to find events associated with a tag?

Question64: When using | timechart by host, which field is represented in the x-axis?

Question65: What are the expected results for a search that contains the command | where A=B?

Question66: These users can create global knowledge objects. (Select all that apply.)

Question67: What are the two parts of a root event dataset?

Question68: Which one of the following statements about the search command is true?

Question69: What does the transaction command do?

Question70: These kinds of charts represent a series in a single bar with multiple sections

Question71: Which of the following is a function of the Splunk Common Information Model (CIM)?

Question72: Which search would limit an "alert" tag to the "host" field?

Question73: When would transaction be used instead of stats?

Question74: When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

Question75: Which command is used to create choropleth maps?

Question76: Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?

Question77: The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

Question78: Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Question79: Splunk alerts can be based on search that run______. (Select all that apply.)

Question80: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Question81: Which workflow action type performs a secondary search?

Question82: How is a Search Workflow Action configured to run at the same time range as the original search?

Question83: Which of the following file formats can be extracted using a delimiter field extraction?

Question84: A data model consists of which three types of datasets?

Question85: Which of the following commands connects an additional table of data directly to the right side of the existing table?

Question86: A user wants a table that will show the total revenue made for each product in each sales region. Which would be the correct SPL query to use?

Question87: Which of the following can be saved as an event type?

Question88: Which of the following can be saved as an event type?

Question89: Which of the following searches will return all clientip addresses that start with 108?

Question90: How is a Search Workflow Action configured to run at the same time range as the original search?

Question91: What field must be present in order to use the timechart command?

Question92: What is the correct way to name a macro with two arguments?

Question93: Which of the following describes the Splunk Common Information Model (CIM) add-on?

Question94: Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?

Question95: When should you use the transaction command instead of the scats command?

Question96: If a search returns ____________ it can be viewed as a chart.

Question97: Which of the following is true about data model attributes?

Question98: What is the purpose of the fillnull command?

Question99: Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Question100: Calculated fields can be based on which of the following?

Question101: Which of the following knowledge objects can reference field aliases?

Question102: Data models are composed of one or more of which of the following datasets? (select all that apply)

Question103: Which of the following statements describes an event type?

Question104: Which field will be used to populate the field if the productName and product:d fields have values for a given event?

Question105: Which of the following eval command functions is valid?

Question106: What is the correct Boolean order of evaluation for the where command from first to last?

Question107: When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied. (Select all that apply).

Question108: To which of the following can a field alias be applied?

Question109: Which of the following expressions could be used to create a calculated field called gigabytes?

Question110: This function of the stats command allows you to identify the number of values a field has.

Question111: Which of the following statements would help a user choose between the transaction and stats commands?

Question112: It is mandatory for the lookup file to have this for an automatic lookup to work.

Question113: Which search string would only return results for an event type called success ful_purchases?

Question114: Which of the following searches will return events containing a tag named Privileged?

Question115: __________ datasets can be added to root dataset to narrow down the search

Question116: Which is not a comparison operator in Splunk

Question117: Which of the following statements describes POST workflow actions?

Question118: What is the correct syntax to search for a tag associated with a value on a specific fields?

Question119: The macro weekly_sales (2) contains the search string:
index-games I eval Product Sales = $price$ $AmountS01d$
Which of the following will return results?

Question120: A calculated field maybe based on which of the following?

Question121: When creating an event type, which is allowed in the search string?

Question122: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on? (select all that apply)

Question123: Which command can include both an over and a by clause to divide results into sub-groupings?

Question124: The eval command 'if' function requires the following three arguments (in order):