It is mandatory for the lookup file to have this for an automatic lookup to work.

• A.Input filed
• B.Source type
• C.At least five columns
• D.Timestamp

Comment: *

Name: *

Email: *

Verification: *

Based on the macro definition shown below, what is the correct way to execute the macro in a search string?

• A.Convert_sales (euro, E, 79)"
• B.Convert_sales (euro, E, .79)
• C.Convert_sales ($euro,$E$,s79$
• D.Convert_sales ($euro, $E$,S,79$)

Comment: *

Name: *

Email: *

Verification: *

Which type of visualization shows relationships between discrete values in three dimensions?

• A.Pie chart
• B.Line chart
• C.Bubble chart
• D.Scatter chart

Comment: *

Name: *

Email: *

Verification: *

Which of the following searches show a valid use of macro? (Select all that apply)

• A.index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
• B.index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
• C.index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
• D.index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

Comment: *

Name: *

Email: *

Verification: *

In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

• A.join
• B.stats
• C.streamstats
• D.transaction

Comment: *

Name: *

Email: *

Verification: *