Use the Fields Sidebar SPLK-1001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst runs `index=security` and sees the `event_type` field in the sidebar with values `login_success` (count: 300) and `login_failure` (count: 15). The analyst wants to focus on the failures. What happens if the analyst clicks `login_failure` in the sidebar?

   • AA new tab opens with the failure events.
   • BThe `event_type` field is removed from the sidebar.
   • CThe search is modified to `index=security event_type="login_failure"` and re-runs, showing only the 15 failure events.
   • DThe results table is sorted by `event_type` in descending order.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of the 'Add to Search' button in the fields sidebar?

   • ATo show the field in the search results
   • BTo add the field to the search string as a filter
   • CTo open the field's statistics in a new tab
   • DTo create a new field extraction for that field
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which section of the fields sidebar lists fields that Splunk has automatically identified as having notable values in your search results?

   • ASelected Fields
   • BAll Fields
   • CInteresting Fields
   • DTop Values
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst runs a search and sees the fields sidebar. Under 'Selected Fields' there are 3 fields, and under 'Interesting Fields' there are 12 fields. What does this difference indicate?

   • ASelected fields are indexed fields; interesting fields are calculated fields only.
   • BSelected fields are from the first 100 events; interesting fields are from all events in the result set.
   • CSelected fields are the ones the analyst explicitly chose to display; interesting fields are automatically extracted from the events.
   • DSelected fields contain numeric data; interesting fields contain only string data.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A user runs a search and sees 5 fields under 'Selected Fields' and 20 fields under 'Interesting Fields'. The user wants to reduce the number of columns in the results table. What is the most direct action?

   • ARemove fields from 'Interesting Fields' by clicking the 'X' next to them.
   • BRemove fields from 'Selected Fields' by clicking the 'X' next to them.
   • CClick the 'Clear All' button at the top of the sidebar.
   • DChange the time range to a shorter period.
   Reveal Solution Discussion Select an answer first