Question 1

How are event types different from saved reports?

Options :

A : Event types cannot be used to organize data into categories.

B : Event types include formatting of the search results.

C : Event types can be shared with Splunk users and added to dashboards.

D : Event types do not include a time range.

Answer: D

Question 2

Data model are composed of one or more of which of the following datasets? (select all that apply.)

Options :

A : Events datasets

B : Search datasets

C : Transaction datasets

D : Any child of event, transaction, and search datasets

Answer: A,B,C

Question 3

A data model can consist of what three types of datasets?

Options :

A : Pivot, searches, and events.

B : Pivot, events, and transactions.

C : Searches, transactions, and pivot.

D : Events, searches, and transactions.

Answer: D

Question 4

What will you learn from the results of the following search? sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)

Options :

A : The average time elapsed during each transaction for all transactions

B : The average time for each event within each transaction

C : The average time between each transaction

Answer: A

Question 5

What is the relationship between data models and pivots?

Options :

A : Data models provide the datasets for pivots.

B : Pivots and data models have no relationship.

C : Pivots and data models are the same thing.

D : Pivots provide the datasets for data models.

Answer: A