Splunk User Certification (Questions And Answers) Rated A+

___ split data by an additional field - by _____ are case sensitive, _______ case insensitive - field names, field values _____ command includes or excludes fields from search results. - Fields _____ is used to pass current results to the next search component - A pipe ______ are how we deal with results (ex. list) (components of search language) - Functions ______ are variables to apply to function (ex. Product name) (components of search language) - Arguments ______ is better than exclusion - inclusion ______ is the most efficient filter - Time ______ mode (default-based on search string data) has field discovery ON for event searches. No event or field data for stats searches. - Smart ______ mode has all events and field data; switches to this mode after visualization - Verbose ______ tell Splunk what we want to do with results (ex. stats) (components of search language) - Commands_______ alerts monitor for events continuously - Real-time _______ are how we want results defined. (components of search language) - Clauses _______ fields have values in at least 20% of the events - Interesting _______ fields that appear by default are host, sourcetype, source - Selected