SPLK-1002 Free Practice Test

- (Exam Topic 1)
Which of the following actions can the eval command perform?

1. A. Remove fields from results.
2. B. Create or replace an existing field.
3. C. Group transactions by one or more fields.
4. D. Save SPL commands to be reused in other searches.

Correct Answer: B

- (Exam Topic 1)
Which of the following statements describes POST workflow actions?

1. A. POST workflow actions are always encrypted.
2. B. POST workflow actions cannot use field values in their URI.
3. C. POST workflow actions cannot be created on custom sourcetypes.
4. D. POST workflow actions can open a web page in either the same window or a new .

Correct Answer: D

- (Exam Topic 1)
A space is an implied _____ in a search string.

1. A. OR
2. B. AND
3. C. ()
4. D. NOT

Correct Answer: B

- (Exam Topic 1)
A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

1. A. Both will appear in the All Fields list, but only if the alias is specified in the search.
2. B. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
3. C. The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
4. D. The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Correct Answer: B

- (Exam Topic 1)
Which delimiters can the Field Extractor (FX) detect? (select all that apply)

1. A. Tabs
2. B. Pipes
3. C. Spaces
4. D. Commas

Correct Answer: ABCD