Which of the following statements describe GET workflow actions?
A. GET workflow actions must be configured with POST arguments.
B. Configuration of GET workflow actions includes choosing a sourcetype.
C. Label names for GET workflow actions must include a field name surrounded by dollar signs.
D. GET workflow actions can be configured to open the URT link in the current window or in a new window
How are event types different from saved reports?
A. Event types cannot be used to organize data into categories.
B. Event types include formatting of the search results.
C. Event types can be shared with Splunk users and added to dashboards.
D. Event types do not include a time range.
Which of the following objects can a calculated field use as a source?
A. An alias of a field.
B. A field added by an automatic lookup.
C. The tag field.
D. The eventtype field.
By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?
A. Turned off
B. Turned on
C. Determined automatically based on the sourcetype.
D. Determined automatically based on the data source.
Which of the following statements describes the use of the Filed Extractor (FX)?
A. The Field Extractor automatically extracts all field at search time.
B. The Field Extractor uses PERL to extract field from the raw events.
C. Field extracted using the Extracted persist as knowledge objects.
D. Fields extracted using the Field Extractor do not persist and must be defined for each search.
This clause is used to group the output of a stats command by a specific name.
A. Rex
B. As
C. List
D. By
Which of the following searches will show the number of categoryld used by each host?
A. Sourcetype=access_* |sum bytes by host
B. Sourcetype=access_* |stats sum(categorylD. by host
C. Sourcetype=access_* |sum(bytes) by host
D. Sourcetype=access_* |stats sum by host
Which field will be used to populate the field if the productName and product:d fields have values for a given event? | eval productINFO=coalesco(productName,productid)
A. Both field values will be used and the product INFO field will become a multivalue field for the given event.
B. The value for the productName field because it appears first.
C. Neither field value will be used and the field will be assigned a NULL value for the given event.
D. The value for the field because it appears second.