SPLK-1002 Practice Test

When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

A.

Rank

B.

Weight

C.

Priority

D.

Precedence

A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

A.

It doesn't matter whether eval or sort is used first.

B.

Convert the numeric to a string with eval first, then sort.

C.

Use sort first, then convert the numeric to a string with eval.

D.

You cannot use the sort command and the eval command on the same field.

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

A.

Tabs

B.

Pipes

C.

Spaces

D.

Commas

To identify all of the contributing events within a transaction that contains at least one REJECT event, which
syntax is correct?

A.

Index-main | REJECT trans sessionid

B.

Index-main | transaction sessionid | search REJECT

C.

Index=main | transaction sessionid | whose transaction=reject

D.

Index=main | transaction sessionid | where transaction=reject’’

Which group of users would most likely use pivots?

A.

Users

B.

Architects

C.

Administrators

D.

Knowledge Managers