Use the Fields Sidebar SPLK-1001 Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   An analyst runs `index=app` and sees the `severity` field in the sidebar with values: `error` (count: 15), `warn` (count: 40), `info` (count: 200). The analyst wants to investigate the `warn` events. What does the sidebar tell the analyst before clicking anything?

   • AThe analyst must click `warn` to see the count.
   • BThere are 40 events with severity `warn` in the current result set.
   • CThe `warn` events are the most severe in the result set.
   • DThere are exactly 40 events with severity `warn` in the entire index.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A user runs a search and the results table shows the `_raw` field, `host`, `source`, `sourcetype`, and `ip_address`. The user wants to add the `user` field to the table as a column. Where should the user look and what should they do?

   • AIn the 'Interesting Fields' section, click the `user` field to add it to 'Selected Fields'.
   • BType `| table user` in the search bar to add the column.
   • CIn the 'Selected Fields' section, click the `user` field to add it.
   • DClick the `+` icon next to the `_raw` column header and select `user`.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst runs `index=mail` and sees the `status` field in the fields sidebar with values `sent`, `failed`, and `deferred`. The analyst wants to see only the `failed` events. What is the most efficient way using the fields sidebar?

   • AClick the `status` field, then click `failed` in the value list.
   • BType `status=failed` in the search bar and press Enter.
   • CClick the `failed` value in the sidebar without first clicking the field.
   • DClick the checkbox next to `status` to select it, then click `failed`.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the fields sidebar, what does the number next to a field value in the 'Top Values' list represent?

   • AThe number of events in the search results that contain that value
   • BThe number of times the field appears in a single event
   • CThe percentage of events that have that value
   • DThe total number of events in the index
   Reveal Solution Discussion Select an answer first