SPLUNK CORE CERTIFIED POWER
USER PRACTICE TEST-1
Which one of the following statements about the search command is true?
A. It does not allow the use of wildcards.
B. It treats field values in a case-sensitive manner.
C. It can only be used at the beginning of the search pipeline.
D. It behaves exactly like search strings before the first pipe. - Correct Answers -D. It
behaves exactly like search strings before the first pipe. (Correct)
Explanation
The following are true about the search command:
1 Use the search command at any point in the search pipeline to filter results
2 Behaves exactly like search strings before the first pipe
3 Search uses the "*" wildcard and treats field values in a case-insensitive manner
Search uses the "*" wildcard and - Correct Answers -treats field values in a case-
insensitive manner
Use the search command at - Correct Answers -any point in the search pipeline to filter
results
Which of the following actions can the eval command perform?
A. Remove fields from results.
B. Create or replace an existing field.
C. Group transactions by one or more fields.
D. Save SPL commands to be reused in other searches. - Correct Answers -B. Create
or replace an existing field. (Correct)
Explanation
The eval command calculates an expression and puts the resulting value into a search
results field.
If the field name that you specify does not match a field in the output, a new field is
added to the search results. [ Creating a field]
If the field name that you specify matches a field name that already exists in the search
results, the results of the eval expression overwrite the values in that field. [Replacing a
field]
, The eval command calculates an - Correct Answers -expression and puts the resulting
value into a search results field.
If the field name that you specify does not match a field in the output, - Correct Answers
-a new field is added to the search results. [ Creating a field]
If the field name that you specify matches a field name that already exists in the search
results, - Correct Answers -the results of the eval expression overwrite the values in that
field. [Replacing a field]
When can a pipe follow a macro?
A. A pipe may always follow a macro.
B. The current user must own the macro.
C. The macro must be defined in the current app.
D. Only when sharing is set to global for the macro. - Correct Answers -A. A pipe may
always follow a macro. (Correct)
Explanation
Using a basic macro - Pipe to more commands, or precede with a search string.
Using a basic macro - - Correct Answers -Pipe to more commands, or precede with a
search string.
Data models are composed of one or more of which of the following datasets? (Choose
all that apply.)
A. Events datasets
B. Search datasets
C. Transaction datasets
D. Any child of event, transaction, and search datasets - Correct Answers -A. Events
datasets (Correct)
B. Search datasets (Correct)
C. Transaction datasets (Correct)
Explanation
Data Model Dataset Types
· Events
· Searches
· Transactions
Data Model Dataset Types - Correct Answers -· Events
· Searches
· Transactions
When using the Field Extractor (FX), which of the following delimiters will work?
(Choose all that apply.)
USER PRACTICE TEST-1
Which one of the following statements about the search command is true?
A. It does not allow the use of wildcards.
B. It treats field values in a case-sensitive manner.
C. It can only be used at the beginning of the search pipeline.
D. It behaves exactly like search strings before the first pipe. - Correct Answers -D. It
behaves exactly like search strings before the first pipe. (Correct)
Explanation
The following are true about the search command:
1 Use the search command at any point in the search pipeline to filter results
2 Behaves exactly like search strings before the first pipe
3 Search uses the "*" wildcard and treats field values in a case-insensitive manner
Search uses the "*" wildcard and - Correct Answers -treats field values in a case-
insensitive manner
Use the search command at - Correct Answers -any point in the search pipeline to filter
results
Which of the following actions can the eval command perform?
A. Remove fields from results.
B. Create or replace an existing field.
C. Group transactions by one or more fields.
D. Save SPL commands to be reused in other searches. - Correct Answers -B. Create
or replace an existing field. (Correct)
Explanation
The eval command calculates an expression and puts the resulting value into a search
results field.
If the field name that you specify does not match a field in the output, a new field is
added to the search results. [ Creating a field]
If the field name that you specify matches a field name that already exists in the search
results, the results of the eval expression overwrite the values in that field. [Replacing a
field]
, The eval command calculates an - Correct Answers -expression and puts the resulting
value into a search results field.
If the field name that you specify does not match a field in the output, - Correct Answers
-a new field is added to the search results. [ Creating a field]
If the field name that you specify matches a field name that already exists in the search
results, - Correct Answers -the results of the eval expression overwrite the values in that
field. [Replacing a field]
When can a pipe follow a macro?
A. A pipe may always follow a macro.
B. The current user must own the macro.
C. The macro must be defined in the current app.
D. Only when sharing is set to global for the macro. - Correct Answers -A. A pipe may
always follow a macro. (Correct)
Explanation
Using a basic macro - Pipe to more commands, or precede with a search string.
Using a basic macro - - Correct Answers -Pipe to more commands, or precede with a
search string.
Data models are composed of one or more of which of the following datasets? (Choose
all that apply.)
A. Events datasets
B. Search datasets
C. Transaction datasets
D. Any child of event, transaction, and search datasets - Correct Answers -A. Events
datasets (Correct)
B. Search datasets (Correct)
C. Transaction datasets (Correct)
Explanation
Data Model Dataset Types
· Events
· Searches
· Transactions
Data Model Dataset Types - Correct Answers -· Events
· Searches
· Transactions
When using the Field Extractor (FX), which of the following delimiters will work?
(Choose all that apply.)
