Use the Fields Sidebar SPLK-1001 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst runs `index=firewall` and looks at the `action` field in the fields sidebar. The sidebar shows: `allowed` (count: 8,450) and `denied` (count: 1,230). What can the analyst conclude from this information?

   • AThe `action` field only exists in 9,680 events out of the total result set.
   • BThe analyst must add `action=denied` to the search to see the denied events.
   • CThe firewall is misconfigured because denied events are fewer than allowed events.
   • DThe majority of firewall events in the current result set were allowed.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A user has a search with many fields in the results table and wants to see only the `_time`, `host`, and `message` columns. What is the most efficient way using the fields sidebar?

   • AType `| fields _time, host, message` in the search bar.
   • BClick the 'Only Show Selected' toggle at the top of the sidebar.
   • CRemove all fields from 'Selected Fields' except `_time`, `host`, and `message`.
   • DAdd `_time`, `host`, and `message` to 'Selected Fields' from 'Interesting Fields'.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the Splunk Web search interface, where is the fields sidebar typically located?

   • AAt the top of the search results
   • BTo the right of the search results
   • CTo the left of the search results
   • DAt the bottom of the search results
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How can you hide a field from the search results using the fields sidebar?

   • AClick the field name in the Interesting Fields list
   • BType `| fields - fieldname` in the search bar
   • CClick the 'Remove' button in the field's details
   • DClick the 'X' icon next to the field in the Selected Fields list
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A user is in the Splunk Search view and has just run a search. The fields sidebar is not visible on the right side. The user sees a small vertical tab on the right edge of the screen. What should the user do to open the fields sidebar?

   • AClick the vertical tab on the right edge of the screen.
   • BClick the 'Settings' menu and select 'Fields Sidebar'.
   • CPress the 'F' key on the keyboard.
   • DRe-run the search to make the sidebar appear.
   Reveal Solution Discussion Select an answer first