Topic 2: Questions Set 2
Clicking a SEGMENT on a chart, ________.
A. drills down for that value
B. highlights the field value across the chart
C. adds the highlighted value to the search criteria
Which of the following expressions could be used to create a calculated field called gigabytes?
A. eval sc_bytes(1024/1024)
B. | eval negabytes=sc_bytes(1024/1024)
C. megabytes=sc_bytes(1024/1024)
D. sc_bytas(1024/1024)
A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.
A. skipped or deferred
B. automatically accelerated
C. deleted
D. all of the above
Explanation: A report that is scheduled to run every 15 minutes but takes 17 minutes to complete is in danger of being skipped or deferred2. This means that Splunk may skip some scheduled runs of the report if they overlap with previous runs that are still in progress or defer them until the previous runs are finished2. This can affect the accuracy and timeliness of the report results and notifications2. Therefore, option A is correct, while options B, C and D are incorrect because they are not consequences of a report taking longer than its schedule interval.
Which of the following can be saved as an event type?
A. index-server_472 sourcetype-BETA_494 code-488 I stats count by code
B. index=server_472 sourcetype=BETA_494 code=488 [I inputlookup append=t servercode.csv]
C. index=server_472 sourcetype=BETA_494 code=488 I stats where code > 200
D. index=server_472 sourcetype=BETA_494 code-488
Explanation:
Event types in Splunk are saved searches that categorize data, making it easier to search
for specific patterns or criteria within your data. When saving an event type, the search
must essentially filter events based on criteria without performing operations that transform or aggregate the data. Here's a breakdown of the options:
A. The searchindex-server_472 sourcetype-BETA_494 code-488 | stats count by code
performs an aggregation operation (stats count by code), which makes it unsuitable for
saving as an event type. Event types are meant to categorize data without aggregating or
transforming it.
B. The searchindex=server_472 sourcetype=BETA_494 code=488 [ | inputlookup
append=t servercode.csv]includes a subsearch and input lookup, which is typically used
to enrich or filter events based on external data. This complexity goes beyond simple event
categorization.
C. The searchindex=server_472 sourcetype=BETA_494 code=488 | stats where code
> 200includes a filtering condition within a transforming command (stats), which again, is
not suitable for defining an event type due to the transformation of data.
D. The searchindex=server_472 sourcetype=BETA_494 code-488is the correct answer
as it purely filters events based on index, sourcetype, and a code field condition without
transforming or aggregating the data. This is what makes it suitable for saving as an event
type, as it categorizes data based on specific criteria without altering the event structure or
content.
In what order arc the following knowledge objects/configurations applied?
A. Field Aliases, Field Extractions, Lookups
B. Field Extractions, Field Aliases, Lookups
C. Field Extractions, Lookups, Field Aliases
D. Lookups, Field Aliases, Field Extractions
Knowledge objects are entities that you create to add knowledge to your data and make it easier to search and analyze2. Some examples of knowledge objects are field extractions, field aliases and lookups2. Field extractions are methods that extract fields from your raw data using various techniques such as regular expressions, delimiters or key-value pairs2. Field aliases are ways to assign alternativenames to existing fields without changing the original field names or values2. Lookups are ways to enrich your data with additional information from external sources such as CSV files or databases2. The order in which these knowledge objects/configurations are applied is as follows: field extractions, field aliases and then lookups2. This means that Splunk first extracts fields from your raw data, then applies any aliases to the extracted fields and then performs any lookups on the aliased fields2. Therefore, option B is correct, while options A, C and D are incorrect.
Which of the following searches can be used to define an event type?
A. index=games sourcetype=score [search index=players | fields player_id]
B. index=games sourcetype=score I where score>9999
C. index=games sourcetype=score player=* score>9999
D. index=games sourcetype=score I stats count by player
Explanation: An event type in Splunk is defined by a search string that returns a specific set of events. The search string index=games sourcetype=score player=* score>9999 is valid because it filters events based on specific criteria directly within the main search command. This search will find all events in the games index with a sourcetype of score, where the player field exists, and the score is greater than 9999. This specificity and direct filtering make it suitable for defining an event type.
| Page 6 out of 46 Pages |
| Previous |
Contact Us - Privacy Policy ... Copyright © - All Rights Reserved