Free Splunk SPLK-1004 Exam Dumps Questions & Answers

How can a lookup be referenced in an alert?

• A.  Upload a lookup file directly to the alert.
• B.  Follow a lookup with an alert command in the search bar.
• C.  Run a search that uses a lookup and save as an alert.
• D.  Use the lookup dropdown in the alert configuration window.

What does Splunk recommend when using the Field Extractor and Interactive Field Extractor (IFX)?

• A.  Use both tools interchangeably for any data type.
• B.  Use the IFX for structured data and the Field Extractor for unstructured data.
• C.  Avoid using both tools for field extraction.
• D.  Use the Field Extractor for structured data and the IFX for unstructured data.

What are the default time and results limits for a subsearch?

• A.  300 seconds and 10,000 results
• B.  60 seconds and 50,000 results
• C.  300 seconds and 50,000 results
• D.  60 seconds and 10,000 results

How is a multivalue field treated from product= " a, b, c, d " ?

• A.  ... | makemv delim= " , " product
• B.  ... | eval mvexpand{makemv{product, " , " }}
• C.  ... | makemv delim{product, " , " }
• D.  ... | mvexpand product

Which of the following is not a common default time field?

• A.  date_minute
• B.  date_year
• C.  date_day
• D.  date_zone