Topic 2: Questions Set 2
Complete the search, …. | _____ failure>successes
A. Search
B. Where
C. If
D. Any of the above
Explanation: The where command can be used to complete the search below.
… | where failure>successes
The where command is a search command that allows you to filter events based on
complex or custom criteria. The where command can use any boolean expression or
function to evaluate each event and determine whether to keep it or discard it. The where
command can also compare fields or perform calculations on fields using operators such
as >, <, =, +, -, etc. The where command can be used after any transforming command that
creates a table or a chart.
The search string below does the following:
It uses … to represent any search criteria or commands before the where
command.
It uses the where command to filter events based on a comparison between two
fields: failure and successes.
It uses the greater than operator (>) to compare the values of failure and
successes fields for each event.
It only keeps events where failure is greater than successes.
Which of the following knowledge objects represents the output of an eval expression?
A. Eval fields
B. Calculated fields
C. Field extractions
D. Calculated lookups
The eval command is used to create new fields or modify existing fields based on an expression2. The output of an eval expression is a calculated field, which is a field that you create based on the value of another field or fields2. You can use calculated fields to enrich your data with additional information or to transform your data into a more useful format2. Therefore, option B is correct, while options A, C and D are incorrect because they are not names of knowledge objects that represent the output of an eval expression.
Which type of workflow action sends field values to an external resource (e.g. a ticketing system)?
A. POST
B. Search
C. GET
D. Format
Explanation: The type of workflow action that sends field values to an external resource (e.g. a ticketing system) is POST. A POST workflow action allows you to send a POST request to a URI location with field values or static values as arguments. For example, you can use a POST workflow action to create a ticket in an external system with information from an event.
Which of the following statements about event types is true? (select all that apply)
A. Event types can be tagged
B. Event types must include a time range
C. Event types categorize events based on a search
D. Event types can be a useful method for capturing and sharing knowledge
As mentioned before, an event type is a way to categorize events based on a search string that matches the events2. Event types can be tagged, which means that you can apply descriptive labels to event types and use them in your searches2. Therefore, option A is correct. Event types categorize events based on a search string, which means that you can define an event type by specifying a search string that matches the events you want to include in the event type2. Therefore, option C is correct. Event types can be a useful method for capturing and sharing knowledge, which means that you can use event types to organize your data into meaningful categories and share them with other users in your organization2. Therefore, option D is correct. Event types do not have to include a time range, which means that you can create an event type without specifying a time range for the events2. Therefore, option B is incorrect.
By default search results are not returned in ________ order.
A. Chronological
B. Reverser chronological
C. ASCIE
D. Alphabetical
When creating a Search workflow action, which field is required?
A. Search string
B. Data model name
C. Permission setting
D. An eval statement
A workflow action is a link that appears when you click an event field value in your search results2. A workflow action can open a web page or run another search based on the field value2. There are two types of workflow actions: GET and POST2. A GET workflow action appends the field value to the end of a URI and opens it in a web browser2. A POST workflow action sends the field value as part of an HTTP request to a web server2. When creating a Search workflow action, which is a type of GET workflow action that runs another search based on the field value, the only required field is the search string2. The search string defines the search that will be run when the workflow action is clicked2. Therefore, option A is correct, while options B, C and D are incorrect because they are not required fields for creating a Search workflow action.
Page 8 out of 46 Pages |
Previous |