- Email support@dumps4free.com
Topic 2: Questions Set 2
When using the transaction command, what does the argument maxspan do?
A. Sets the maximum total time between events in a transaction.
B. Sets the maximum length of all events within a transaction.
C. Sets the maximum total time between the earliest and latest events in a transaction.
D. Sets the maximum length that any single event can reach to be included in the transaction.
The stats command will create a _____________ by default.
A. Table
B. Report
C. Pie chart
When would transaction be used instead of stats
A. To group events based on a single field value.
B. To see results of a calculation
C. To have a faster and more efficient search
D. To group events based on start/end values
Explanation: The transaction command is used to group events that are related by some common fields or conditions, such as start/end values, time span, or pauses. The stats command is used to calculate statistics on a group of events by a common field value.
How is an event type created from the search window? (select all that apply)
A. In the top right corner, click Save As > Event Type.
B. In an event's detail dropdown, click Event Actions > Build Event Type.
C. Edit eventtypes.conf and add a new stanza.
D. Add | eventtype to the SPL and execute the search.
Explanation:
In Splunk, you can create an event type from the search window by running a search that
would make a good event type, then clicking Save As and selecting Event Type1. This
opens the Save as Event Type dialog, where you can provide the event type name and
optionally apply tags to it1.
You can also create an event type by editing the eventtypes.conf file and adding a new
stanza1. Each stanza in the eventtypes.conf file represents an event type1. The stanza
name isthe name of the event type, and the search attribute specifies the search string that
defines the event type1.
Which method in the Field Extractor would extract the port number from the following
event? |
10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin
A. Delimiter
B. rex command
C. The Field Extractor tool cannot extract regular expressions
D. Regular expression
Explanation: The rex command allows you to extract fields from events using regular
expressions. You can use the rex command to specify a named group that matches the
port number in the event. For example:
rex "\+\+\+\+port (?
This will create a field called port with the value 54 for the event.
The delimiter method is not suitable for this event because there is no consistent delimiter
between the fields. The regular expression method is not a valid option for the Field
Extractor tool. The Field Extractor tool can extract regular expressions, but it is not a
method by itself.
| Page 3 out of 55 Pages |
| Previous |