Question 1

Which predefined drilldown token passes a clicked value from a table row?

Options :

A :

B :

C :

D :

Answer: A

Question 2

How can the erex and rex commands be used in conjunction to extract fields?

Options :

A :

The regex Generated by the erex command can be edited and used with the regex command in a subsequent search.

B :

The regex generated by the rex command can be edited and used with the erex command in a subsequent search.

C :

The regex generated by the erex command can be edited and used with the erex command in a subsequent search.

D : The erex and rex commands cannot be used in conjunction under any circumstances.

Answer: A

Question 3

Which of the following would exclude all entries contained in the lookup file baditems. csv from search results?

Options :

A : NOT [inputlookup baditems.csv]

B : NOT (lookup baditems.csv OUTPUT item)

C : WHERE item NOT IN (baditems.csv)

D : [NOT inputlookup baditems.csv]

Answer: A

Question 4

Which of the following cannot be accomplished with a webhook alert action?

Options :

A : Retrieve data from a web page

B : Create a ticket in a support app

C : Post a notification on a web page

D : Post a message in a chatroom

Answer: A

Question 5

Why is the transaction command slow in large splunk deployments?

Options :

A : It forces the search to run in fast mode.

B : transaction or runs on each Indexer in parallel.

C : It forces all event data to be returned to the search head.

D : transaction runs a hidden eval to format fields.

Answer: C

Higher Test Marks with Free Online SPLK-1004 Exam Practice