EMT Practice Test

1. Question Content...

---

Question1: Which of the following has a schema or structure embedded in the data itself?

Question2: When would a distributable streaming command be executed on an Indexer?

Question3: What is returned when Splunk finds fewer than the minimum matches for each lookup value?

Question4: What arguments are required when using the spath command?

Question5: How can the inspect button be disabled on a dashboard panel?

Question6: How is a muitlvalue Add treated from product-"a, b, c, d"?

Question7: Which statement about tsidx files is accurate?

Question8: When and where do search debug messages appear to help with troubleshooting views?

Question9: What is the recommended way to create a field extraction that is both persistent and precise?

Question10: What is the correct hierarchy of XML elements in a dashboard panel?

Question11: What command is used la compute find write summary statistic, to a new field in the event results?

Question12: Where does the output of an append command appear in the search results?

Question13: How can form inputs impact dashboard panels using inline searches?

Question14: Which of the following is accurate about cascading inputs?

Question15: Which commands should be used in place of a subsearch if possible?

Question16: Which statement about the coalesce function is accurate?

Question17: A report named "Linux logins" populates a summary index with the search string sourcetype=linux_secure| sitop src_ip user. Which of the following correctly searches against the summary index for this data?

Question18: What are the four types of event actions?

Question19: If a nested macro expands to a search string that begins with a generating command, what additional syntax is needed?

Question20: What order of incoming events must be supplied to the transaction command to ensure correct results?

Question21: Which of the following Is valid syntax for the split function?

Question22: How is regex passed to the makemv command?

Question23: Which of the following best describes the process for tokenizing event data?

Question24: which function of the stats command creates a multivalue entry?

Question25: When running a search, which Splunk component retrieves the individual results?

Question26: When using a nested search macro, how can an argument value be passed to the inner macro?

Question27: Which of the following is accurate regarding predefined drilldown tokens?

Question28: Which of these generates a summary index containing a count of events by productId?

Question29: What type of drilldown passes a value from a user click into another dashboard or external page?