问题 39
This function of the stats command allows you to identify the number of values a field has.

问题 40
The following searches will return the same results. SEARCH 1: ssh error SEARCH 2: ssh AND error

问题 41
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

问题 42
What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid,
icid | timechart avg(duration)

问题 43
What is required for a macro to accept three arguments?

问题 44
Which of the following statements describes POST workflow actions?

问题 45
What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)

问题 46
How many ways are there to access the Field Extractor Utility?

问题 47
Which are valid ways to create an event type? (select all that apply)

问题 48
哪种说法是正确的？

问题 49
Which command can include both an overand a byclause to divide results into sub-groupings?

问题 50
__________ datasets can be added to root dataset to narrow down the search

问题 51
What does the fillnull command replace null values with, it the value argument is not specified?

问题 52
Which workflow action method can be used when the action type is set to link?

问题 53
A user wants to convert field values to string and also to sort on those value. Which command should be used first, the eval or the sort?

问题 54
Which of the following statements describe the Common Information Model (QM)? (select all that apply)

问题 55
When using the transaction command, what does the argument maxspan do?

问题 56
In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

问题 57
This search user!=*_________________.