SPLK-1002 Sample Questions & Answers

The macro name is sessiontracker and the arguments are action, JESSIONI

The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

Both will appear in the All Fields list, but only if the alias is specified in the search.

Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.

The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.

The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

stats can only group events using IP addresses.

The transaction command is faster and more efficient.

There is a 1000 event limitation with the transaction command.

Use stats when the events need to be viewed as a single correlated event.

All events in a transaction must have the same timestamp.

All events in a transaction must have the same sourcetype.

All events in a transaction must have the exact same set of fields.

All events in a transaction must be related by one or more fields.

Event types can be tagged.

Event types must include a time range.

Event types categorize events based on a search.

Event types can be a useful method for capturing and sharing knowledge.

it doesn't matter whether eval or sort is used first.

Convert the numeric to a string with eval first, then sort.

Use sort first, then convert the numeric to a string with eval.

You cannot use the sort command and the eval command on the same field.

Tabs

Pipes

Colons

Spaces

0

N/A

NaN

NULL

Field Aliases, Field Extractions, Lookups

Field Extractions, Field Aliases, Lookups

Field Extractions, Lookups, Field Aliases

Lookups, Field Aliases, Field Extractions

index=main REJECT | transaction sessionid

index=main | transaction sessionid | search REJECT

index=main | transaction sessionid | where transaction=reject

index=main | transaction sessionid | where transaction-'REJECT*'