All About Precise SPLK-1002 Braindumps

NEW QUESTION 1

Which of the following can be used with the eval command tostring function (select all that apply)

• A. ‘’hex’’
• B. ‘’commas’’
• C. ‘’Decimal’’
• D. ‘’duration’’

Answer: ABD

NEW QUESTION 2

Calculated fields can be based on which of the following?

• A. Tags
• B. Extracted fields
• C. Output fields for a lookup
• D. Fields generated from a search string

Answer: B

NEW QUESTION 3

Which of the following statements about data models and pivot are true? (select all that apply)

• A. They are both knowledge objects.
• B. Data models are created out of datasets called pivots.
• C. Pivot requires users to input SPL searches on data models.
• D. Pivot allows the creation of data visualizations that present different aspects of a data model.

Answer: BD

NEW QUESTION 4

This tab shows you the event patterns in the results of a specific search.

• A. statistics
• B. visualization
• C. patterns

Answer: C

NEW QUESTION 5

Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

• A. Events in the transaction occurred within 5 seconds.
• B. It groups events that share the same clientip and host.
• C. The first and last events are no more than 5 seconds apart.
• D. The first and last events are no more than 30 seconds apart.

Answer: B

NEW QUESTION 6

Which search would limit an "alert" tag to the "host" field?

• A. tag=alert
• B. host::tag::alert
• C. tag==alert
• D. tag::host=alert

Answer: D

NEW QUESTION 7

Which of the following statements describes this search? sourcetype=access_combined I transaction JSESSIONID | timechart avg (duration)

• A. This is a valid search and will display a timechart of the average duration, of each transaction event.
• B. This is a valid search and will display a stats table showing the maximum pause among transactions.
• C. No results will be returned because the transaction command must include the startswith and endswith options.
• D. No results will be returned because the transaction command must be the last command used in the search pipeline.

Answer: A

NEW QUESTION 8

Which of the following statements describe calculated fields? (select all that apply)

• A. Calculated fields can be used in the search bar.
• B. Calculated fields can be based on an extracted field.
• C. Calculated fields can only be applied to host and sourcetype.
• D. Calculated fields are shortcuts for performing calculations using the eval command.

Answer: BD

NEW QUESTION 9

Which of the following knowledge objects represents the output of an oval expression?

• A. Eval fields
• B. Calculated fields
• C. Field extractions
• D. Calculated lookups

Answer: C

NEW QUESTION 10

In what order arc the following knowledge objects/configurations applied?

• A. Field Aliases, Field Extractions, Lookups
• B. Field Extractions, Field Aliases, Lookups
• C. Field Extractions, Lookups, Field Aliases
• D. Lookups, Field Aliases, Field Extractions

Answer: B

NEW QUESTION 11

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

• A. Tabs
• B. Pipes
• C. Spaces
• D. Commas

Answer: ABCD

NEW QUESTION 12

After manually editing; a regular expression (regex), which of the following statements is true?

• A. Changes made manually can be reverted in the Field Extractor (FX) UI.
• B. It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.
• C. It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.
• D. The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that wasmanually edited.

Answer: D

NEW QUESTION 13

What do events in a transaction have In common?

• A. All events In a transaction must have the same timestamp.
• B. All events in a transaction must have the same sourcetype.
• C. All events in a transaction must have the exact same set of fields.
• D. All events in a transaction must be related by one or more fields.

Answer: B

NEW QUESTION 14

When should you use the transaction command instead of the scats command?

• A. When you need to group on multiple values.
• B. When duration is irrelevant in search result
• C. .
• D. When you have over 1000 events in a transaction.
• E. When you need to group based on start and end constraints.

Answer: C

NEW QUESTION 15

Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

• A. | datamodel web search | filed web *
• B. | Search datamodel web web | filed web*
• C. | datamodel web web field | search web*
• D. Datamodel=web | search web | filed web*

Answer: A

NEW QUESTION 16

Which of the following searches will return events contains a tag name Privileged?

• A. Tag= Priv
• B. Tag= Priv*
• C. Tag= Priv*
• D. Tag= Privileged

Answer: D

NEW QUESTION 17

The gauge command:

• A. creates a single-value visualization
• B. allows you to set colored ranges for a single-value visualization
• C. creates a radial gauge visualization

Answer: B

NEW QUESTION 18

A calculated field maybe based on which of the following?

• A. Lookup tables
• B. Extracted fields
• C. Regular expressions
• D. Fields generated within a search string

Answer: B

NEW QUESTION 19

What is the relationship between data models and pivots?

• A. Data models provide the datasets for pivots.
• B. Pivots and data models have no relationship.
• C. Pivots and data models are the same thing.
• D. Pivots provide the datasets for data models.

Answer: D

NEW QUESTION 20

A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

• A. It doesn't matter whether eval or sort is used first.
• B. Convert the numeric to a string with eval first, then sort.
• C. Use sort first, then convert the numeric to a string with eval.
• D. You cannot use the sort command and the eval command on the same field.

Answer: B

NEW QUESTION 21

The transaction command allows you to ______ events across multiple sources

• A. duplicate
• B. correlate
• C. persist
• D. tag

Answer: B

NEW QUESTION 22

What does the fillnull command replace null values with, it the value argument is not specified?

• A. N/A
• B. NaN
• C. NULL

Answer: A

NEW QUESTION 23

Which are valid ways to create an event type? (select all that apply)

• A. By using the searchtypes command in the search bar.
• B. By editing the event_type stanza in the props.conf file.
• C. By going to the Settings menu and clicking Event Types > New.
• D. By selecting an event in search results and clicking Event Actions > Build Event Type.

Answer: CD

NEW QUESTION 24

When using the transaction command, what does the argument maxspan do?

• A. Sets the maximum total time between events in a transaction.
• B. Sets the maximum length of all events within a transaction.
• C. Sets the maximum total time between the earliest and latest events in a transaction.
• D. Sets the maximum length that any single event can reach to be included in the transaction.

Answer: B

NEW QUESTION 25
......