SPLK-1001 Practice Test

What is the correct syntax to count the number of events containing a vendor_action field?

A.

count stats vendor_action

 

B.

count stats (vendor_action) 

C.

stats count (vendor_action) 

D.

stats vendor_action (count)

By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

 

 

A.

host

B.

index

C.

C. source

D.

sourcetype

 

When looking at a dashboard panel that is based on a report, which of the following is true?

 

 

A.

You can modify the search string in the panel, and you can change and configure the visualization.

B.

You can  modify  the  search  string  in  the  panel,  but  you  cannot  change  and  configure  the visualization.

 

C.

You cannot  modify  the  search  string  in  the  panel,  but  you  can  change  and  configure  the visualization.

 

D.

You  cannot  modify  the  search  string  in  the  panel,  and  you  cannot  change  and  configure  the visualization.

Which of the following is a best practice when writing a search string?

 

 

A.

Include all formatting commands before any search terms

 

B.

Include at least one function as this is a search requirement

 

C.

Include the search terms at the beginning of the search string

 

D.

Avoid using formatting clauses as they add too much overhead

 

What type of search can be saved as a report?

A.

Any search can be saved as a report

 

B.

Only searches that generate visualizations

 

C.

Only searches containing a transforming command

 

D.

Only searches that generate statistics or visualizations