Question 1

Which of the following would exclude all entries contained in the lookup file baditems. csv from search results?

Options :

A : NOT [inputlookup baditems.csv]

B : NOT (lookup baditems.csv OUTPUT item)

C : WHERE item NOT IN (baditems.csv)

D : [NOT inputlookup baditems.csv]

Answer: A

Question 2

Which predefined drilldown token passes a clicked value from a table row?

Options :

A :

B :

C :

D :

Answer: A

Question 3

Where can wildcards be used in the tstats command?

Options :

A : No wildcards can be used with

B : In the where to clause.

C : In the from clause.

D : In the by clause.

Answer: C

Question 4

Which of the following has a schema or structure embedded in the data itself?

Options :

A : Dark data

B : Unstructured data

C : Embedded data

D : Self-describing data

Answer: D

Question 5

Why is the transaction command slow in large splunk deployments?

Options :

A : It forces the search to run in fast mode.

B : transaction or runs on each Indexer in parallel.

C : It forces all event data to be returned to the search head.

D : transaction runs a hidden eval to format fields.

Answer: C

Higher Test Marks with Free Online SPLK-1004 Exam Practice