QUESTION 39
This function of the stats command allows you to identify the number of values a field has.

QUESTION 40
The following searches will return the same results. SEARCH 1: ssh error SEARCH 2: ssh AND error

QUESTION 41
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

QUESTION 42
What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid,
icid | timechart avg(duration)

QUESTION 43
What is required for a macro to accept three arguments?

QUESTION 44
Which of the following statements describes POST workflow actions?

QUESTION 45
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

QUESTION 46
How many ways are there to access the Field Extractor Utility?

QUESTION 47
Which are valid ways to create an event type? (select all that apply)

QUESTION 48
Which statement is true?

QUESTION 49
Which command can include both an overand a byclause to divide results into sub-groupings?

QUESTION 50
__________ datasets can be added to root dataset to narrow down the search

QUESTION 51
What does the fillnull command replace null values with, it the value argument is not specified?

QUESTION 52
Which workflow action method can be used when the action type is set to link?

QUESTION 53
A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

QUESTION 54
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

QUESTION 55
When using the transaction command, what does the argument maxspan do?

QUESTION 56
In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

QUESTION 57
This search user!=*_________________.