SP_5

How to make Interesting field into a selected field?

• Click field in field sidebar -> click YES on the pop-up dialog on upper right side -> check now field should be visible in the list of selected fields.

• Not possible.

• Only CLI changes will enable it.

• Click Settings -> Find field option -> Drop down selected field -> enable selected field -> check now field should be visible in the list of selected fields.

Field names are case sensitive and field value are not.

• True

• False

!= and NOT are same arguments.

• True

• False

Query - status ! = 100.

• Will return event where status field exist but value of that field is not 100.

• Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

• Will get different results depending on data.

NOT status = 100:

• Will display result depending on the data.

• Will return event where status field exist but value of that field is not 100.

• Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

Will the queries following below get the same result? 1. index=log sourcetype=error_log status!=100 2. index=log sourcetype=error_log NOT status=100

• A.Yes

• B.No

Select the best options for "search best practices" in Splunk: (Choose five.)

• Select the time range always.

• Try to specify index values.

• Include as many search terms as possible.

• Inclusion is generally better than exclusion.

• Try to keep specific search terms.

The better way of writing search query for index is:

• A.index=a index=b

• B.(index=a OR index=b)

• C.index=(a & b)

• D.index = a, b

Put query into separate lines where | (Pipes) are used by selecting following options.

• CTRL + Enter

• Shift + Enter

• Space + Enter

• ALT + Enter

Fields are searchable key value pairs in your event data.

• True

• False