SPLK-1004 Field Management And Calculated Fields Practice Test 2 — 15 Questions

Question 1

When using the 'inputfields' parameter in a lookup definition, what happens?

Accepted Answer

It maps search-time fields to lookup table columns.. The inputfields parameter defines which fields in your search results should map to the fields in the lookup table.

Answer

It restricts the output fields to only those specified.

Answer

It hides the lookup results from unauthorized users.

Answer

It automatically indexes the lookup data.

Question 2

You want to create a lookup that updates automatically as new data arrives. Which feature should you use?

Accepted Answer

KV Store lookup.. A KV store lookup allows for dynamic updates, unlike a static CSV lookup.

Answer

Field alias.

Answer

Calculated field.

Answer

CSV file lookup.

Question 3

Which of the following is true about field extractions?

Accepted Answer

They use regular expressions to parse data.. Field extractions can be defined using regular expressions, which extract data from raw events.

Answer

They are only available for the 'admin' role.

Answer

They must be defined at index time.

Answer

They only work on JSON data.

Question 4

A user complains that a calculated field is not showing up. Which of the following is the best first step to troubleshoot?

Accepted Answer

Check if the field is in the 'Selected Fields' or 'Interesting Fields' list.. Checking the 'Selected Fields' list in the search results is the best way to see if the field is present and extracted.

Answer

Restart the Splunk service.

Answer

Change the indexer's cluster master.

Answer

Delete the index and re-ingest the data.

Question 5

What is the purpose of the 'tags.conf' file?

Accepted Answer

It stores user-defined tags.. It stores the associations between tags and field-value pairs.

Answer

It defines the search string for an event type.

Answer

It manages lookup table file paths.

Answer

It configures the web interface dashboard colors.

Question 6

How can you view all existing field aliases in the Splunk Web interface?

Accepted Answer

Settings > Fields > Field aliases.. Settings > Fields > Field aliases is the path to manage all aliases.

Answer

Settings > Data inputs.

Answer

Settings > Lookups.

Answer

Settings > Indexes.

Question 7

Which TWO of the following are valid ways to create field extractions?

Accepted Answer

Using the Field Extractor UI tool.. The Field Extractor (UI) and editing props.conf/transforms.conf are the two standard ways.

Answer

Editing indexes.conf.

Answer

Modifying the raw log files on the disk.

Answer

Using the 'index' command in the search bar.

Question 8

When creating a calculated field, what does the 'EVAL-' prefix in props.conf indicate?

Accepted Answer

It indicates a calculated field definition.. The 'EVAL-' prefix tells Splunk that the following expression should be evaluated as a calculated field.

Answer

It identifies a field for a lookup table.

Answer

It marks the field as a source for an alias.

Answer

It forces the field to be indexed.

Question 9

Which TWO of the following are true about Tags?

Accepted Answer

Tags can be applied to event types.. Tags can be applied to field-value pairs and event types, and they are case-insensitive.

Answer

Tags can only be created by the admin user.

Answer

Tags are case-sensitive.

Answer

Tags must be defined in indexes.conf.

Question 10

Which TWO of the following are valid lookup types?

Accepted Answer

KV Store lookup.. CSV lookups and KV Store lookups are two of the most common types in Splunk.

Answer

Raw log lookup.

Answer

SQL lookup.

Answer

TXT file lookup.

Question 11

You have a field 'ip_address' and want to tag it with 'internal' for specific subnets. What is the most efficient way to manage this?

Accepted Answer

Create an event type for the subnet, then tag the event type.. Event types can be used to label the subnets, and then tags can be applied to those event types.

Answer

Manually tag every IP event one by one.

Answer

Write a search that updates the raw data.

Answer

Use a calculated field to add the tag.

Question 12

Which TWO of the following are steps required to configure a CSV lookup?

Accepted Answer

Upload the CSV file.. Uploading the file and defining the lookup object are the two fundamental steps.

Answer

Modify the raw data to include the CSV headers.

Answer

Restart the Splunk indexer.

Answer

Add the CSV to the license manager.

Question 13

Which THREE of the following are standard configuration files for field management?

Accepted Answer

transforms.conf. props.conf, transforms.conf, and fields.conf are all critical for defining field behavior.

Answer

indexes.conf

Answer

inputs.conf

Question 14

Which THREE of the following are valid ways to search for a tag named 'production'?

Accepted Answer

tag::production. You can use the tag:: prefix, search for the specific tag field, or use the UI to filter.

Answer

tag::*=production

Answer

field=production

Question 15

Which THREE of the following are benefits of using calculated fields?

Accepted Answer

They allow for complex string manipulations.. They enable mathematical operations, conditional logic, and string manipulations at search time.

Answer

They are stored as raw data.

Answer

They automatically increase index speed.