Splunk SPLK-1002 Quiz 2 Topic 10 Questions 6-10

Question: 1

What does the following search do?

index=condlog type=mysterymeat action=eaten I scats count as cornlog_count by us:

ACreates a table of the total count of users and split by corndogs.

BCreates a table of the total count of mysterymeat corndogs split by user.

CCreates a table with the count of all types of corndogs eaten split by user.

DCreates a table that groups the total number of users by vegetarian corndogs.

Show Answer

Question: 2

Which of the following statements is true, especially in largo environments?

AUse the scats command when you next to group events by two or more fields.

BThe scats command is faster and more efficient than the transaction command

CThe transaction command is faster and more efficient than the stats command.

DUse the transaction command when you want to see the results of a calculation.

Show Answer

Question: 3

Which of the following actions can the aval command perform?

ARemove fields from results.

BCreate or replace an existing field.

CGroup transactions by one or more fields.

DSave SPL commands to be reused in other searches.

Show Answer

Question: 4

A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

AIt doesn't matter whether eval or sort is used first.

BConvert the numeric to a string with eval first, then sort.

CUse sort first, then convert the numeric to a string with eval.

DYou cannot use the sort command and the eval command on the same field.

Show Answer

Question: 5

When using timechart, how many fields can be listed after a by clause? ( Choose Two )

Abecause timechart doesn't support using a by clause.

Bbecause _time is already implied as the x-axis.

Cbecause one field would represent the x-axis and the other would represent the y-axis.

DThere is no limit specific to timechart.

Show Answer

Splunk SPLK-1002 Quiz:2 Topic:10 Questions:6-10