Describe the Relationship Between Data Models and Pivot SPLK-1002 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A user is building a pivot from the 'Web_Logs' data model. The pivot uses the 'All_Requests' object and shows counts by 'status'. The user wants to add a drill-down to see the individual events for a specific status code. What is required for drill-down to work?

   • AThe data model must have a defined hierarchy with child objects.
   • BThe 'status' field must be defined as a numeric type.
   • CThe user must have the 'edit_pivot' permission.
   • DThe pivot must be saved as a report before drill-down is enabled.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How do constraints defined in a data model affect a pivot built from that model?

   • AThey are ignored by the pivot editor and only apply to data model searches.
   • BThey prevent the pivot from being shared with other users.
   • CThey limit the data that the pivot can display to events that match the constraints.
   • DThey determine the visual style of the pivot table.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A user is creating a pivot from the 'Sales' data model. The pivot uses the 'Orders' object and shows 'order_total' as a sum in the Cell Values area. The user wants to also show the average order total in the same pivot. What is the correct way to add this?

   • ADrag 'order_total' to the Cell Values area again and change the aggregation to 'Average'.
   • BAdd a filter to calculate the average.
   • CChange the existing metric from 'Sum' to 'Average'.
   • DCreate a new pivot with 'Average' as the only metric.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A data model 'App_Logs' has a root object 'All_Logs' with a constraint `app_name=webapp`. A child object 'Errors' has a constraint `log_level=ERROR`. A user creates a pivot using the 'Errors' object and wants to see a count of events by 'user_id'. However, the pivot returns zero results. What is the most likely explanation?

   • AThe 'user_id' field is not defined in the 'Errors' object.
   • BThe pivot is limited to the first 100 events in the data model.
   • CNo events match both `app_name=webapp` AND `log_level=ERROR`.
   • DThe 'user_id' field is a multi-value field and cannot be counted.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A data model 'Firewall_Logs' has a root object 'All_Events' with a constraint `sourcetype=firewall`. A child object 'Blocked' has a constraint `action=block`. A user creates a pivot using 'Blocked' and wants to see counts by 'src_ip'. The pivot returns data, but the user notices that the counts are lower than expected when compared to a search for `sourcetype=firewall action=block`. What is the most likely reason for the discrepancy?

   • AThe 'Blocked' object has an additional constraint that the search does not have.
   • BThe 'src_ip' field is a multi-value field and is counted differently.
   • CThe data model is not accelerated, so the pivot uses a sample of events.
   • DThe pivot is limited to the first 1000 events by default.
   Reveal Solution Discussion Select an answer first