Splunk Core Certified Power User Free Sample Questions

POST

Action

Search

Sub-search

tag=

tag= ( )

tag= ::

tag:: =

tag=

tag= ( )

tag= ::

tag:: =

Fields and variables.

Fields and attributes.

Constraints and fields.

Constraints and lookups.

date

host

time

_time

The macro name is sessiontracker and the arguments are action, JESSIONI

The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

Both will appear in the All Fields list, but only if the alias is specified in the search.

Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

stats can only group events using IP addresses.

The transaction command is faster and more efficient.

There is a 1000 event limitation with the transaction command.

Use stats when the events need to be viewed as a single correlated event.

All events in a transaction must have the same timestamp.

All events in a transaction must have the same sourcetype.

All events in a transaction must have the exact same set of fields.

All events in a transaction must be related by one or more fields.

Event types can be tagged.

Event types must include a time range.

Event types categorize events based on a search.

Event types can be a useful method for capturing and sharing knowledge.