The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization. If another person in the organization runs the shared report and no results are returned, why might this be? (select all that apply)

• A.Fast mode is enabled.
• B.The dashboard is private.
• C.The extraction is private-
• D.The person in the organization running the report does not have access to the index.

Comment: *

Name: *

Email: *

Verification: *

When should transactionbe used?

• A.Only in a large distributed Splunk environment.
• B.When calculating results from one or more fields.
• C.When event grouping is based on start/end values.
• D.When grouping events results in over 1000 events in each group.

Comment: *

Name: *

Email: *

Verification: *

Which of the following knowledge objects represents the output of an oval expression?

• A.Calculated lookups
• B.Calculated fields
• C.Field extractions
• D.Eval fields

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements describes field aliases?

• A.Field aliases only normalize data across sources and sourcetypes.
• B.Field aliases can be used in lookup file definitions.
• C.Field alias names replace the original field name.
• D.Field alias names are not case sensitive when used as part of a search.

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements about tags is true?

• A.Tags are case insensitive.
• B.Tags can make your data more understandable.
• C.Tags are created at index time.
• D.Tags are searched by using the syntax tag::<fieldname>

Comment: *

Name: *

Email: *

Verification: *