SPLK-1002 Free Practice Test

- (Exam Topic 1)
A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

1. A. It doesn't matter whether eval or sort is used first.
2. B. Convert the numeric to a string with eval first, then sort.
3. C. Use sort first, then convert the numeric to a string with eval.
4. D. You cannot use the sort command and the eval command on the same field.

Correct Answer: B

- (Exam Topic 1)
Which of the following statements is true, especially in large environments?

1. A. Use the scats command when you next to group events by two or more fields.
2. B. The stats command is faster and more efficient than the transaction command
3. C. The transaction command is faster and more efficient than the stats command.
4. D. Use the transaction command when you want to see the results of a calculation.

Correct Answer: B

- (Exam Topic 1)
Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

1. A. | datamodel web search | filed web *
2. B. | Search datamodel web web | filed web*
3. C. | datamodel web web field | search web*
4. D. Datamodel=web | search web | filed web*

Correct Answer: A

- (Exam Topic 2)
Clicking a SEGMENT on a chart, _______.

1. A. drills down for that value
2. B. highlights the field value across the chart
3. C. adds the highlighted value to the search criteria

Correct Answer: C

- (Exam Topic 2)
The eval command 'if' function requires the following three arguments (in order):

1. A. Boolean expression, result if true, result if false
2. B. Result if true, result if false, boolean expression
3. C. Result if false, result if true, boolean expression
4. D. Boolean expression, result if false, result if true

Correct Answer: A