EMT Practice Test

1. Question Content...

---

Question1: A data model can consist of what three types of datasets?

Question2: Which of the following searches would create a graph similar to the one below?

Question3: Which of the following searches show a valid use of a macro? (Choose all that apply.)

Question4: Which statement is true?

Question5: Which of the following options will define the first event in a transaction?

Question6: Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Question7: What is required for a macro to accept three arguments?

Question8: When used with the timechart command, which value of the limit argument returns all values?

Question9: Which of the following statements about data models and pivot are true? (select all that apply)

Question10: These kinds of charts represent a series in a single bar with multiple sections

Question11: Which statement is true?

Question12: Given the following eval statement:
...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

Question13: What information must be included when using the datamodel command?

Question14: A calculated field is a shortcut for performing repetitive, long, or complex transformations using which of the following commands?

Question15: Which of these search strings is NOT valid:

Question16: What fields does the transaction command add to the raw events? (select all that apply)

Question17: When is a GET workflow action needed?

Question18: Which delimiters can the Field Extractor (FX) detect? (select all that apply)

Question19: Highlighted search terms indicate _________ search results in Splunk.

Question20: A calculated field may be based on which of the following?

Question21: Which of the following expressions could be used to create a calculated field called gigabytes?

Question22: __________ datasets can be added to root dataset to narrow down the search

Question23: What are the two parts of a root event dataset?

Question24: When using | timchart by host, which filed is representted in the x-axis?

Question25: What approach is recommended when using the Splunk Common Information Model (CIM) add-on to normalize data?

Question26: The Splunk Common Information Model (CIM) is a collection of what type of knowledge object?

Question27: What is the correct format for naming a macro with multiple arguments?

Question28: Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize dat a. in addition to field aliases, event types, and tags?

Question29: When using the transaction command, what does the argument maxspan do?

Question30: Which of the following is a feature of the Pivot tool?

Question31: When should you use the transaction command instead of the scats command?

Question32: Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

Question33: A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Question34: How is a Search Workflow Action configured to run at the same time range as the original search?

Question35: What is the correct way to name a macro with two arguments?

Question36: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question37: How is a Search Workflow Action configured to run at the same time range as the original search?

Question38: Consider the following search:
index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD470K92802F117). View the events as a group.
From the following list, which search groups events by JSESSIONID?

Question39: How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)

Question40: Which of the following searches will return events contains a tag name Privileged?

Question41: Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Question42: A field alias is created where field1-fieid2 and the Overwrite Field Values checkbox is selected.
What happens if an event only contains values for fieid1?

Question43: What happens to the original field name when a field alias is created?

Question44: For the following search, which field populates the x-axis?
index=security sourcetype=linux secure | timechart count by action

Question45: When creating a Search workflow action, which field is required?

Question46: Which one of the following statements about the search command is true?

Question47: Data model are composed of one or more of which of the following datasets? (select all that apply.)

Question48: What are the expected results for a search that contains the command | where A=B?

Question49: Which of the following is included with the Splunk Common Information Model (CIM) Add-on?

Question50: Where are the descriptions of the data models that come with the Splunk Common Information Model (CIM) Add-on documented?

Question51: What is the purpose of the fillnull command?

Question52: Which of the following commands connects an additional table of data directly to the right side of the existing table?

Question53: Which of the following statements are true for this search? (Select all that apply.) SEARCH:
sourcetype=access* |fields action productld status

Question54: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question55: This clause is used to group the output of a stats command by a specific name.

Question56: Which of the following statements about tags is true?

Question57: Which of the following statements is true, especially in large environments?

Question58: Field aliases are used to __________ data

Question59: In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

Question60: Which of the following transforming commands can be used with transactions?

Question61: Which of the following statements describe the Common Information Model (CIM)? (select all that apply)

Question62: These allow you to categorize events based on search terms.
Select your answer.

Question63: Which of the following statements describe GET workflow actions?

Question64: Which of the following statements describes calculated fields?

Question65: Which of the following can be used with the eval command tostring function (select all that apply)

Question66: Which tool uses data models to generate reports and dashboard panels without using SPL?

Question67: When should the regular expression mode of Field Extractor (FX) be used? (select all that apply)

Question68: Which of the following is true about the Splunk Common Information Model (CIM)?

Question69: What is the Splunk Common Information Model (CIM)?

Question70: When using multiple expressions in a single eval command, which delimiter is used?

Question71: The fields sidebar does not show________. (Select all that apply.)

Question72: Which workflow action method can be used the action type is set to link?

Question73: Which of the following can be saved as an event type?

Question74: A macro has another macro nested within it, and this inner macro requires an argument. How can the user pass this argument into the SPL?

Question75: What is the relationship between data models and pivots?

Question76: Which of the following searches will return all clientip addresses that start with 108?

Question77: How does a user display a chart in stack mode?

Question78: During the validation step of the Field Extractor workflow:
Select your answer.

Question79: The stats command will create a _____________ by default.

Question80: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question81: Which of the following definitions describes a macro named "samplemacro" that accepts two arguments?

Question82: In which Settings section are macros defined?

Question83: Which of the following knowledge objects can reference field aliases?

Question84: A user wants to create a workflow action that will retrieve a specific field value from an event and run a search in a new browser window in the user's Splunk instance. What kind of workflow action should they create?

Question85: Which of the following searches will show the number of categoryld used by each host?

Question86: In what order arc the following knowledge objects/configurations applied?

Question87: Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)

Question88: When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied.
(Select all that apply).

Question89: When would transaction be used instead of stats?

Question90: When using the transaction command, how are evicted transactions identified?

Question91: Which of the following objects can a calculated field use as a source?

Question92: Which of the following statements describes the use of the Filed Extractor (FX)?

Question93: Which of the following statements describes an event type?

Question94: What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

Question95: We can use the rename command to _____ (Select all that apply.)

Question96: For the following search, which command would further filter for only IP addresses present more than five times?

Question97: The eval command 'if' function requires the following three arguments (in order):

Question98: Which of the following is true about data sets used in the Pivot tool?

Question99: Which search string would only return results for an event type called success ful_purchases?

Question100: When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

Question101: Which of the following Statements about macros is true? (select all that apply)

Question102: Which of the following statements about tags is true? (select all that apply.)

Question103: Which of these is NOT a field that is automatically created with the transaction command?

Question104: Which of the following searches show a valid use of macro? (Select all that apply)

Question105: Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

Question106: These users can create global knowledge objects. (Select all that apply.)

Question107: When does the CIM add-on apply preconfigured data models to the data?

Question108: Data model fields can be added using the Auto-Extracted method. Which of the following statements describe Auto-Extracted fields? (select all that apply)

Question109: What commands can be used to group events from one or more data sources?

Question110: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question111: Which field extraction method should be selected for comma-separated data?

Question112: Why would the following search produce multiple transactions instead of one?

Question113: When can a pipe follow a macro?

Question114: When a search returns __________, you can view the results as a list.

Question115: Which of the following statements describe calculated fields? (select all that apply)

Question116: Two separate results tables are being combined using the |join command. The outer table has the following values:
Refer to following Tables

The line of SPL used to join the tables is: | join employeeNumber type=outer How many rows are returned in the new table?

Question117: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Question118: A data model consists of which three types of datasets?

Question119: Which of the following statements best describes a macro?

Question120: What will you learn from the results of the following search?
sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

Question121: To create a tag, which of the following conditions must be met by the user?

Question122: Which of the following data model are included In the Splunk Common Information Model (CIM) add-on?
(select all that apply)

Question123: Which of the following statements describes the use of the Field Extractor (FX)?

Question124: Which of the following search control will not re-rerun the search? (Select all that apply.)

Question125: Data models are composed of one or more of which of the following datasets? (select all that apply)