Online Access Free SPLK-1002 Practice Test

When would a user select delimited field extractions using the Field Extractor (FX)?

• A.When a log file contains empty lines or comments.
• B.When a log file has values that are separated by the same character, for example, commas.
• C.When the file has a header that might provide information about its structure or format.
• D.With structured files such as JSON or XML.

Which are valid ways to create an event type? (select all that apply)

• A.By going to the Settings menu and clicking Event Types > New.
• B.By using the searchtypes command in the search bar.
• C.By editing the event_type stanza in the props.conf file.
• D.By selecting an event in search results and clicking Event Actions > Build Event Type.

Information needed to create a GET workflow action includes which of the following? (select all that apply.)

• A.A name of the workflow action
• B.A name for the URI where the user will be directed at search time.
• C.A label that will appear in the Event Action menu at search time.
• D.A URI where the user will be directed at search time.

Which of the following options should a user add to a search to limit transactions to a five minute time window?

• A.duration=5m
• B.maxspan=5m
• C.bin=5m
• D.earliest=-5m

How is a macro referenced in a search?

• A.By using the macroname command.
• B.By using the macro command.
• C.By enclosing the macro name in backtick characters (').
• D.By enclosing the macro name in single-quote characters (').