1
Which of the following conditions could cause a lispy expression to not create tokens?
A wildcard at the beginning of a search
A minor breaker in the middle of a search
A major breaker in the middle of a search
A wildcard at the end of a search
2
Where in the search pipeline are transforming commands executed?
On the indexer
Inside a warm bucket
Inside a hot bucket
On the search head
3
Which component of the Search Job Inspector shows how long a search took to execute?
Execution Costs
Search Job Properties
Execution Time Range
Header
4
Which of the following breakers would be used first in segmentation?
Commas
Periods
Colons
Hyphens
5
Which component of a bucket stores raw event data?
Journal
Posting List
TSIDX files
Lexicon
6
If a search begins with a distributable streaming command, where is it first executed?
On the indexer
It depends on whether or not the command is a centralized command
On the search head
It depends on whether or not the command is a transforming command
7
Which directive can be used in a search to bypass minor breakers inside the supplied argument?
TERM
LISPY
RETURN
INCLUDE
8
Which architectural component of a Splunk deployment initiates a search?
Search Head
Indexer
Buckets
Forwarder
9
After Splunk tokenizes terms at index time, where are the tokens stored?
In the lexicon
In a bloom filter
In the posting list
In a frozen bucket
10
Where can comments be placed in a search?
Comments must be placed at the beginning of a search.
Comments can be placed anywhere inside a search.
Comments can be placed anywhere, provided they follow a pipe.
Comments must be placed at the end of a search.
11
When is a bucket's bloom filter created?
When a search is run.
When a TSIDX file is created.
When a bucket rolls from hot to warm.
When a bucket rolls from warm to cold.
12
Which of the following expressions builds a search-time bloom filter?
A regular expression
A macro expression
An eval expression
A lispy expression
13
Which of the following syntaxes signify a comment in SPL?
```comment```
`comment`
´´´comment´´´
'''comment'''
14
Where should the makeresults command be placed within a search?
The makeresults command can be used anywhere after initial terms in a search
The makeresults command can be used anywhere in a search
The makeresults command must be the final command in a search
The makeresults command must be the first command in a search
15
Which of the following commands generates temporary search results?
tempresults
makeresults
genresults
count
