SPLK-1001 無料問題集「Splunk Core Certified User」

（A）When an event in a search matches up with a data model

（B）When Splunk encounters a syntax error in a search

（C）When a trigger action meets the predefined conditions

（D）When results of a search meet a specifically defined condition

（A）source

（B）index

（C）host

（D）sourcetype

（A）index=*

（B）(index=web OR index=sales)

（C）index=web OR index=s*

（D）*index=sales AND index=web*

（A）In ascending order by action, then descending order by file, and lastly by ascending order of bytes.

（B）In descending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

（C）In descending order by action, then descending order by file, and lastly by ascending order of bytes.

（D）In ascending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

（A）Group_Object_Description

（B）Group_Description_Object

（C）Description_Group_Object

（D）Object_Group_Description

（A）Input Phase

（B）None of the above

（C）License Metering

（D）Indexing Phase

（E）Parsing Phase

（A）Only continuous monitoring.

（B）Only One-time monitoring.

（C）None of the above.

（D）Both One-time and continuous monitoring

（A）Yes

（B）Only HF

（C）No

（A）It is only available to Admins.

（B）Shows options to complete the search string

（C）Such feature does not exist in Splunk.

（A）Host

（B）Sourcetype

（C）Source

（D）Index

（A）False

（B）True

（A）sourcetype=access_* | maximum totals by bytes

（B）sourcetype=access_* | max(bytes)

（C）sourcetype=access_* | avg (bytes)

（D）sourcetype=access_* | stats max(bytes)

（A）Yes

（B）No