QUESTION 153
What does the fillnull command replace null values with, if the value argument is not specified?

QUESTION 154
Marty has multiple data sources that contain fields with IP Address values. What knowledge object should he use to normalize the fields so his data is CIM compliant?

QUESTION 155
What does the following search do?

QUESTION 156
Fast, optimized and verbose are all selectable search modes.

QUESTION 157
Which of the following is true about data sets used in the Pivot tool?

QUESTION 158
Which field will be used to populate the field if the productName and product:d fields have values for a given event?
| eval productINFO=coalesco(productName,productid)

QUESTION 159
which of the following commands are used when creating visualizations(select all that apply.)

QUESTION 160
What are the two parts of a root event dataset?

QUESTION 161
A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

QUESTION 162
A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

QUESTION 163
Which is not a comparison operator in Splunk

QUESTION 164
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

QUESTION 165
Which of the following search modes automatically returns all extracted fields in the fields sidebar?

QUESTION 166
When using the Field Extractor (FX), which of the following delimiters will work? (select all that apply)

QUESTION 167
Which statement is true?

QUESTION 168
Which of the following statements describe the search string below?
| datamodel Application_State All_Application_State search

QUESTION 169
For the following search, which command would further filter for only IP addresses present more than five times?

QUESTION 170
Which of the following is NOT a stats function:

QUESTION 171
When multiple event types with different color values are assigned to the same event, what determines the color displayed for the events?

QUESTION 172
All users by default have WRITE permission to ALL knowledge objects.