splunk

1. Which search would limit an "alert" tag to the "host" field? - A) tag=alert | B) tag::host=alert | C) host::tag::alert | D) tag==alert (Answer: B)

2. How should a macro with two arguments be named in Splunk? - A) macroname | B) macroname(2) | C) macro-2 | D) macro[arg1,arg2] (Answer: B)

3. Which command computes a running total of 'bytes' per host? - A) stats sum(bytes) by host | B) eventstats sum(bytes) by host | C) streamstats sum(bytes) by host | D) transaction host (Answer: C)

4. When charting a metric over time, which transforming command is best? - A) chart | B) timechart | C) table | D) tstats (Answer: B)

5. Which rex correctly extracts the 'user' value from key=value pairs? - A) rex field=raw 'user=(?\w+)' | B) rex field=raw '(?user=\w+)' | C) rex field=_raw 'user=(?P\w+)' | D) extract field=user (Answer: A)

6. Which command loads all rows from a CSV lookup into the pipeline? - A) lookup users.csv | B) inputlookup users.csv | C) outputlookup users.csv | D) dbxlookup users.csv (Answer: B)

7. How do you count distinct users per host? - A) stats count(user) by host | B) stats dc(user) by host | C) eventstats dc(user) by host | D) tstats count FROM datamodel (Answer: B)

8. Which condition matches any user starting with 'adm'? - A) where user like 'adm' | B) where like(user,"adm%") | C) where match(user,'^adm$') | D) search user=adm (case-sensitive) (Answer: B)

9. Which syntax creates a session per user with max gap of 30 minutes? - A) transaction by user maxspan=30m | B) transaction user maxspan=30m | C) transaction user span=30m | D) stats by user span=30m (Answer: B)

10. Which Workflow Action opens a new search when clicked? - A) GET | B) POST | C) Search | D) Inline (Answer: C)

11. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

12. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

13. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

14. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

15. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

16. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

17. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

18. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

19. What is the purpose of the 'dedup' command in Splunk? - A) Executes dedup at index time | B) Performs dedup-related operation at search time | C) Stores data for dedup in indexes | D) Creates alerts for dedup automatically (Answer: B)

20. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

21. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

22. What is the purpose of the 'dedup' command in Splunk? - A) Executes dedup at index time | B) Performs dedup-related operation at search time | C) Stores data for dedup in indexes | D) Creates alerts for dedup automatically (Answer: B)

23. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

24. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

25. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

26. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

27. What is the purpose of the 'lookup' command in Splunk? - A) Executes lookup at index time | B) Performs lookup-related operation at search time | C) Stores data for lookup in indexes | D) Creates alerts for lookup automatically (Answer: B)

28. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

29. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

30. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

31. What is the purpose of the 'dedup' command in Splunk? - A) Executes dedup at index time | B) Performs dedup-related operation at search time | C) Stores data for dedup in indexes | D) Creates alerts for dedup automatically (Answer: B)

32. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

33. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

34. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

35. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

36. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

37. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

38. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

39. What is the purpose of the 'lookup' command in Splunk? - A) Executes lookup at index time | B) Performs lookup-related operation at search time | C) Stores data for lookup in indexes | D) Creates alerts for lookup automatically (Answer: B)

40. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

41. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

42. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

43. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

44. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

45. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

46. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

47. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

48. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

49. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

50. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

51. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

52. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

53. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

54. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

55. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

56. What is the purpose of the 'dedup' command in Splunk? - A) Executes dedup at index time | B) Performs dedup-related operation at search time | C) Stores data for dedup in indexes | D) Creates alerts for dedup automatically (Answer: B)

57. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

58. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

59. What is the purpose of the 'lookup' command in Splunk? - A) Executes lookup at index time | B) Performs lookup-related operation at search time | C) Stores data for lookup in indexes | D) Creates alerts for lookup automatically (Answer: B)

60. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

61. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

62. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

63. What is the purpose of the 'dedup' command in Splunk? - A) Executes dedup at index time | B) Performs dedup-related operation at search time | C) Stores data for dedup in indexes | D) Creates alerts for dedup automatically (Answer: B)

64. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

65. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

66. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

67. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

68. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

69. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

70. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

71. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

72. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

73. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

74. What is the purpose of the 'lookup' command in Splunk? - A) Executes lookup at index time | B) Performs lookup-related operation at search time | C) Stores data for lookup in indexes | D) Creates alerts for lookup automatically (Answer: B)

75. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

76. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

77. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

78. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

79. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

80. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

81. What is the purpose of the 'lookup' command in Splunk? - A) Executes lookup at index time | B) Performs lookup-related operation at search time | C) Stores data for lookup in indexes | D) Creates alerts for lookup automatically (Answer: B)

82. What is the purpose of the 'dedup' command in Splunk? - A) Executes dedup at index time | B) Performs dedup-related operation at search time | C) Stores data for dedup in indexes | D) Creates alerts for dedup automatically (Answer: B)

83. What is the purpose of the 'lookup' command in Splunk? - A) Executes lookup at index time | B) Performs lookup-related operation at search time | C) Stores data for lookup in indexes | D) Creates alerts for lookup automatically (Answer: B)

84. What is the purpose of the 'transaction' command in Splunk? - A) Executes transaction at index time | B) Performs transaction-related operation at search time | C) Stores data for transaction in indexes | D) Creates alerts for transaction automatically (Answer: B)

85. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

86. What is the purpose of the 'dedup' command in Splunk? - A) Executes dedup at index time | B) Performs dedup-related operation at search time | C) Stores data for dedup in indexes | D) Creates alerts for dedup automatically (Answer: B)

87. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

88. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

89. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

90. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

91. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

92. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

93. What is the purpose of the 'eval' command in Splunk? - A) Executes eval at index time | B) Performs eval-related operation at search time | C) Stores data for eval in indexes | D) Creates alerts for eval automatically (Answer: B)

94. What is the purpose of the 'spath' command in Splunk? - A) Executes spath at index time | B) Performs spath-related operation at search time | C) Stores data for spath in indexes | D) Creates alerts for spath automatically (Answer: B)

95. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

96. What is the purpose of the 'timechart' command in Splunk? - A) Executes timechart at index time | B) Performs timechart-related operation at search time | C) Stores data for timechart in indexes | D) Creates alerts for timechart automatically (Answer: B)

97. What is the purpose of the 'rex' command in Splunk? - A) Executes rex at index time | B) Performs rex-related operation at search time | C) Stores data for rex in indexes | D) Creates alerts for rex automatically (Answer: B)

98. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)

99. What is the purpose of the 'stats' command in Splunk? - A) Executes stats at index time | B) Performs stats-related operation at search time | C) Stores data for stats in indexes | D) Creates alerts for stats automatically (Answer: B)

100. What is the purpose of the 'fillnull' command in Splunk? - A) Executes fillnull at index time | B) Performs fillnull-related operation at search time | C) Stores data for fillnull in indexes | D) Creates alerts for fillnull automatically (Answer: B)