Use Data Preview to Validate Event Creation During the Parsing Phase CLOUD-CERTIFIED-ADMIN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When using Data Preview, what does seeing multiple events in the event display indicate?

   • AThe data input has been configured incorrectly
   • BThe data source is sending duplicate data
   • CThe raw data is being broken into separate events during parsing
   • DThe data is being indexed into multiple indexes
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In the Data Preview interface, which section shows the raw data that has been broken into individual events?

   • ASource information
   • BEvent display
   • CTimeline
   • DField extraction
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An admin is validating a new input in Data Preview and notices that some events are missing the 'user' field, even though the raw data contains it. The admin wants to fix this so that all events have the 'user' field. What should the admin do?

   • AModify the line breaking settings to split events at the 'user' field.
   • BSet the host field to the 'user' value to ensure it is captured.
   • CReview the field extraction rules to ensure they match all variations of the 'user' field in the raw data.
   • DChange the timestamp extraction to use the 'user' field as the timestamp.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An admin is validating a new input in Data Preview. The events are being created correctly, but the field extraction pane shows that the 'status' field has a value of '200' for all events, even though the raw data contains different status codes like '404' and '500'. What is the most likely cause?

   • AThe line breaking settings are merging events, causing all status values to be the same.
   • BThe host field is being set to the status value, overwriting the extracted field.
   • CThe timestamp extraction is incorrectly parsing the status field as the timestamp.
   • DThe field extraction is using a regex that matches the first occurrence of 'status' in the raw data, which is always '200'.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An admin is using Data Preview to validate a new JSON input. The preview shows events with correct timestamps and source, but the field extraction pane does not display the 'user_id' and 'action' fields that are present in the raw JSON. What should the admin do first to troubleshoot this issue?

   • ARestart the Splunk Cloud instance to force re-indexing of the JSON data.
   • BCheck the host field to ensure it is correctly assigned from the JSON payload.
   • CVerify that the sourcetype is set to a JSON-aware sourcetype such as _json.
   • DConfirm that the timestamp is being parsed correctly from the JSON timestamp field.
   Reveal Solution Discussion Select an answer first