Online Access Free SPLK-1002 Exam Questions

A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

• A.Convert the numeric to a string with eval first, then sort.
• B.Use sort first, then convert the numeric to a string with eval.
• C.It doesn't matter whether eval or sort is used first.
• D.You cannot use the sort command and the eval command on the same field.

When creating a data model, which root dataset requires at least one constraint?

• A.Root search dataset
• B.Root transaction dataset
• C.Root event dataset
• D.Root child dataset

Two separate results tables are being combined using the join command. The outer table has the following values:
The inner table has the following values:

The line of SPL used to join the tables is: join employeeNumber type=outer How many rows are returned in the new table?

• A.Three
• B.Zero
• C.Eight
• D.Five

Which of the following searches show a valid use of macro? (Select all that apply)

• A.index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
• B.index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
• C.index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
• D.index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

By default search results are not returned in ________ order.

• A.ASCIE
• B.Reverser chronological
• C.Alphabetical
• D.Chronological