A. status code>403 status_code<405
B. status_code !=404
C. status_code>=400
D. status_code<=404
A. Calculates statistics on data that matches the search criteria
B. Converts field values into numerical values
C. Analyzes numerical fields for their ability to predict another discrete field
D. Automatically correlates related fields
A. Splunk automatically discovers only fields directly related to the search results
B. Splunk automatically discovers only manually configured fields
C. Splunk automatically discovers only numeric fields
D. Splunk automatically discovers only alphanumeric fields
A. The lookup definition must be created.
B. The lookup command must be used.
C. The lookup file must be verified using the inputlookup command.
D. The lookup file must be uploaded to Splunk.
A. Any naming convention is fine as long as you keep an external spreadsheet to keep track.
B. Use a consistent naming convention so they are easily separated by characteristics such as group and object.
C. Name reports as uniquely as possible with no overlap to differentiate them from one another.
D. Reports are best named using many numbers so they can be more easily sorted.
A. the_questionnaire _pedia
B. the_questionnaire pedia
C. the_questionnaire Pedia
D. the_questionnaire_pedia
A. | rename Action as "Customer Action"
B. | rename action as "Customer Action"
C. | rename Action to "Customer Action"
D. | rename action = CustomerAction
A. Alerts are based on searches and when triggered will only send an email notification.
B. Alerts are based on searches that are run exclusively as real-time.
C. Alerts are based on searches that are either run on a scheduled interval or in real-time.
D. Alerts are based on searches and require cron to run on scheduled interval.
A. Index=Security
B. index!=Security
C. Index=security
D. index=Security
A. AND
B. NOT
C. OR
D. XOR
A. sourcetype
B. clientip
C. action
D. index
A. Parsing Phase
B. Input Phase
C. None of the above
D. Indexing Phase
E. License Metering
A. count stats vendor_action
B. stats vendor_action (count)
C. stats count (vendor_action)
D. count stats (vendor_action)
A. indexer name-index_name
B. index name=index_name
C. indexer-index_name
D. index=index_name
