Question 1

What information must be included when using the datamodel command?

Options :

A : status field

B : Multiple indexes

C : Data model field name.

D : Data model dataset name.

Answer: D

Question 2

A data model consists of which three types of datasets?

Options :

A : Constraint, field, value.

B : Events, searches, transactions.

C : Field extraction, regex, delimited.

D : Transaction, session ID, metadata.

Answer: B

Question 3

How could the following syntax for the chart command be rewritten to remove the OTHER category? (select all that apply)

Options :

A : | chart count over CurrentStanding by Action useother=f

B : | chart count over CurrentStanding by Action usenull-f useother-t

C : | chart count over CurrentStanding by Action limit=10 useother=f

D : | chart count over CurrentStanding by Action limit-10

Answer: A,C

Question 4

Which of the following statements describe calculated fields? (select all that apply)

Options :

A : Calculated fields can be used in the search bar.

B : Calculated fields can be based on an extracted field.

C : Calculated fields can only be applied to host and sourcetype.

D : Calculated fields are shortcuts for performing calculations using the eval command.

Answer: A,B,D

Question 5

Which of the following statements best describes a macro?

Options :

A : A macro is a method of categorizing events based on a search.

B : A macro is a way to associate an additional (new) name with an existing field name.

C : A macro is a portion of a search that can be reused in multiple place

D : A macro is a knowledge object that enables you to schedule searches for specific events.

Answer: C