Following are the time selection option while making search: (Choose all that apply.)
A. Date & Time Range
B. Advanced
C. Date Range
D. Presets
E. Relative
Which of the statements is correct regarding click and drag option in timeline?
A. The new result after selecting the range by dragging filters the events and displays the most recent first.
B. There is no functionality like click and drag in Splunk's timeline.
C. Using this option executes a new query.
D. This doesn't execute a new query
Field names are case sensitive and field value are not.
A. True
B. False
Splunk automatically determines the source type for major data types.
A. False
B. True
What is the result of the following search?
index=myindex source=c: \mydata. txt NOT error=*
A. Only data where the error field is present and does not contain a value will be displayed
B. Only data with a value in the field error will be displayed
C. Only data that does not contain the error field will be displayed
D. Only data where the value of the field error does not equal an asterisk (*) will be displayed.
Explanation: The search query index=myindex source=c: \mydata. txt NOT error=*
specifies three criteria for the events to be returned:
The index must be myindex, which is a user-defined index that contains the data
from a specific source or sources.
The source must be c: \mydata. txt, which is the name of the file or directory where
the data came from.
The error field must not exist in the events, which is indicated by the NOT operator
and the wildcard character (*).
The NOT operator negates the following expression, which means that it returns the events
that do not match the expression. The wildcard character () matches any value, including
an empty value or a null value. Therefore, the expression NOT error= means that the
events must not have an error field at all, regardless of its value.
The search query does not use quotation marks around the source value, which means
that it is case-sensitive and exact. If there are any variations in the source name, such as
capitalization or spacing, they will not match the query.
What is the correct order of steps for creating a new lookup?
1. Configure the lookup to run automatically
2. Create the lookup table
3. Define the lookup
A. 2, 1, 3
B. 1, 2, 3
C. 2, 3, 1
D. 3, 2, 1
| Page 4 out of 41 Pages |
| Previous |
Contact Us - Privacy Policy ... Copyright © - All Rights Reserved