Free SPLK-1002 Exam braindumps download (SPLK-1002 exam dumps Free)

QUESTION: 41

When using timechart, how many fields can be listed after a by clause?

0, because timechart doesn't support using a by clause.
1, because _time is already implied as the x-axis.
2, because one field would represent the x-axis and the other would represent the y-axis.
There is no limit specific to timechart.

Answer(s): B

QUESTION: 42

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.
Which field name appears in the results?

Both will appear in the All Fields list, but only if the alias is specified in the search.
Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Answer(s): B

Show Answer Next Question

QUESTION: 43

Which of the following statements describes macros?

A macro is a reusable search string that must contain the full search.
A macro is a reusable search string that must have a fixed time range.
A macro is a reusable search string that may have a flexible time range.
A macro is a reusable search string that must contain only a portion of the search.

Answer(s): C

Reference:

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Definesearchmacros

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/WhatisSplunkknowledge

Show Answer Next Question