Question 1mediummultiple choice
Read the full Data Models and Best Practices explanation →SPLK-1002 Data Models and Best Practices • Complete Question Bank
Complete SPLK-1002 Data Models and Best Practices question bank — all 0 questions with answers and detailed explanations.
Refer to the exhibit. # props.conf [apache_error] TRANSFORMS-set = set_error_type # transforms.conf [set_error_type] REGEX = \[(error|warn|info)\] FORMAT = error_type::$1 DEST_KEY = _meta
Refer to the exhibit. index=web sourcetype=access_combined | stats count by status | where count > 1000
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag a concept onto its matching description — or click a concept then click the description.
Tails a file or directory for new data
Receives syslog data via UDP or TCP
Runs a script to collect data
Receives data via HTTP or HTTPS
Collects Windows Event Log data
Drag a concept onto its matching description — or click a concept then click the description.
Default index for all data unless otherwise specified
Stores pre-computed results for faster searches
Optimized for numeric metric data
Stores data model acceleration data
| datamodel Web search | where status=500 | stats count by uri_path
props.conf: [web_access] DATETIME_CONFIG = /etc/datetime.xml MAX_TIMESTAMP_LOOKAHEAD = 20 TIME_PREFIX = ^ TIME_FORMAT = %d/%b/%Y:%H:%M:%S
props.conf: [default] DATETIME_CONFIG = CURRENT DATA_MODEL = Authentication
[datamodel] app = search name = Authentication [datamodel/Authentication/constraint] sourcetype = auth_log [datamodel/Authentication/fields/action] type = string
| datamodel list Data model App Type Accelerated? Status Web_Traffic search root Yes Summaries require rebuild Error_Logs search root No -
Error: tstats search includes invalid argument: datamodel= Search command: | tstats count from datamodel=Web_Traffic.Failed_Pages
Refer to the exhibit.
Data model definition:
{
"dataModel": {
"objectName": "Authentication",
"fieldList": [
{"fieldName": "user", "type": "string"},
{"fieldName": "action", "type": "string"},
{"fieldName": "src_ip", "type": "ip"},
{"fieldName": "_time", "type": "time"},
{"fieldName": "duration", "type": "number"}
],
"constraints": [
{"field": "action", "comparison": "IN", "value": ["login", "logout"]}
],
"acceleration": {
"enabled": true,
"summaryRange": "1d",
"maxTime": "30d"
}
}
}