Use Data Preview to Validate Event Creation During the Parsing Phase CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An admin is validating a new input in Data Preview. The events are being created, but the timestamps are showing one hour ahead of the actual time in the raw data. The raw data contains timestamps in UTC, and the admin's Splunk Cloud instance is set to Eastern Time. What should the admin do to fix the timestamp discrepancy?

   • ASet the host field to the timezone of the server.
   • BChange the timestamp format to include the timezone offset in the raw data.
   • CConfigure the input to set the TZ (timezone) to UTC in the timestamp extraction settings.
   • DModify the line breaking settings to split events at the timezone indicator.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   After observing in Data Preview that events are not being created correctly, what is an appropriate action to take?

   • AChange the index to a different one
   • BRestart the Splunk Cloud instance
   • CModify the input settings or parsing rules
   • DDelete the data input and recreate it
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Splunk Web page provides the entry point to launch Data Preview for a specific input?

   • ASettings > Indexes
   • BSettings > Data inputs
   • CSearch app > Data Summary
   • DSettings > Source types
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When reviewing the field extraction section in Data Preview, what should you check to ensure fields are correctly extracted?

   • AThat the fields are sorted alphabetically
   • BThat the fields are all of type string
   • CThat the fields are all visible in the event display
   • DThat the field names and values match the expected data
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An admin is validating a new input in Data Preview. The events are being created, but the 'src_ip' field is missing from some events. The raw data shows that 'src_ip' is present in all events, but in some events it appears as 'src_ip=192.168.1.1' and in others as 'src_ip: 192.168.1.1'. The admin wants to extract 'src_ip' consistently. What should the admin do?

   • ACreate a custom field extraction regex that matches both 'src_ip=' and 'src_ip:' patterns.
   • BChange the timestamp extraction to use the 'src_ip' field.
   • CModify the line breaking settings to split events at the 'src_ip' field.
   • DSet the host field to the 'src_ip' value.
   Reveal Solution Discussion Select an answer first