Fields are searchable key value pairs in your event data.

• A.True
• B.False

Comment: *

Name: *

Email: *

Verification: *

Which of the following describes lookup files?

• A.Lookup fields cannot be used in searches.
• B.Lookups contain static data available in the index.
• C.Lookups add more fields to results returned by a search.
• D.Lookups pull data at index time and add them to search results.

Comment: *

Name: *

Email: *

Verification: *

It is no possible for a single instance of Splunk to manage the input, parsing and indexing of machine data.

• A.False
• B.True

Comment: *

Name: *

Email: *

Verification: *

Which statement is true about Splunk alerts?

• A.Alerts are based on searches and when triggered will only send an email notification.
• B.Alerts are based on searches that are either run on a scheduled interval or in real-time.
• C.Alerts are based on searches and require cron to run on scheduled interval.
• D.Alerts are based on searches that are run exclusively as real-time.

Comment: *

Name: *

Email: *

Verification: *

A field exists in search results, but isn't being displayed in the fields sidebar. How can it be added to the fields sidebar?

• A.Click All Fields and select the field to add it to Selected Fields.
• B.Click Interesting Fields and select the field to add it to Selected Fields.
• C.Click Selected Fields and select the field to add it to Interesting Fields.
• D.This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.

Comment: *

Name: *

Email: *

Verification: *