Describe, Create, and Use Calculated Fields SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A calculated field named 'response_time_ms' is defined with the eval expression `(end_time - start_time) * 1000`. A user runs a search that includes `index=web` and wants to see the calculated field in the results. What must the user do to see this field?

   • AThe user must include the eval expression in the search manually, because calculated fields are not applied automatically.
   • BThe user must run the search against the same index where the calculated field was created.
   • CThe user must use the `fields` command to explicitly request the calculated field in the search.
   • DThe user must ensure the search uses the same source type for which the calculated field was defined.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When is a calculated field applied to events in a search?

   • AAt input time, before the event is indexed
   • BAt index time, when the event is stored
   • CAt report time, only when generating a report
   • DAt search time, after the events are retrieved
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An admin created a calculated field named 'user_agent_browser' that extracts the browser name from a user agent string. After a recent update to the user agent format, the field is no longer producing correct values. The admin wants to modify the eval expression. What is the correct way to do this?

   • AEdit the calculated field in Settings > Fields > Calculated Fields and update the eval expression.
   • BRun a search with a new eval expression and save it as a report to override the calculated field.
   • CDelete the calculated field and create a new field extraction with the same name.
   • DUse the `rename` command in a search to change the field's values temporarily.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does a calculated field differ from an extracted field in Splunk?

   • ACalculated fields can only be created by administrators, while extracted fields can be created by any user
   • BCalculated fields are stored in the index, while extracted fields are not
   • CCalculated fields are used only in reports, while extracted fields are used only in searches
   • DCalculated fields are created from existing fields using an eval expression, while extracted fields are parsed from raw event data
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When creating a calculated field in Splunk Web, which of the following must you specify?

   • AEval expression, time range, and permissions
   • BField name, lookup table, and output format
   • CSource type, index, and regular expression
   • DDestination app, name, and eval expression
   Reveal Solution Discussion Select an answer first