Splunk - Using Fields Quiz with
Complete Answers
True or False: Fields are knowledge objects.
(A) False
(B) True ✔✔(B) True
At search time, if an event has an equal(=) sign, the data to the left is treated as a ____
...
Splunk - Using Fields Quiz with
Complete Answers
True or False: Fields are knowledge objects.
(A) False
(B) True ✔✔(B) True
At search time, if an event has an equal(=) sign, the data to the left is treated as a ______ and the
data to the right is treated as a ______.
(A) field name, value
(B) field name, sourcetype
(C) lookup, sourcetype
(D) lookup, value ✔✔(A) field name, value
The fields command allows you to do which of the following? Select all that apply.
(A) Exclude fields (fields -)
(B) Include fields (fields)
(C) Include fields (fields +) ✔✔(A) Exclude fields (fields -)
(B) Include fields (fields)
(C) Include fields (fields +)
In the Fields sidebar, Interesting Fields occur in at least ________ of resulting events.
(A) 20%
(B) 3%
(C) 50%
(D) 10% ✔✔(A) 20%
True or False: Once you rename a field, the new field name must be used in the rest of the search
string.
(A) False
(B) True ✔✔(B) True
To remove fields from a search, you would use the _________ command.
(A) fields-
(B) -fields
(C) +fields
(D) fields+ ✔✔(A) fieldsAt search time, _______ extracts fields from raw event data.
(A) field discovery
(B) fields command
(C) field extractor ✔✔(A) field discovery
Which of the following fields are default selected fields?
(A) Host
(B) Source
(C) Sourcetype
(D) Index ✔✔(A) Host
(B) Source
(C) Sourcetype
[Show More]
.png)
