A user wants to create a workflow action that will retrieve a specific field value from an event and run a search in a new browser window in the user's Splunk instance. What kind of workflow action should they create?

• A. A Run workflow action, because the user is running a new search with a specific field value from an event returned in the user's search.
• B. A POST workflow action, because the search is being sent to the user's current Splunk instance.
• C. A Search workflow action, because the user is running a new search with a specific field value from an event returned in the user's search.
• D. A GET workflow action, because a field value needs to be retrieved from the events returned in the user's search.

Sally created several tags for employees of Buttercup Games. She tagged each employee's badge number with the department name and location. Which search query would Sally use to filter for employees of the Marketing department who do not work in the San_Francisco office?

• A. tag=Marketing exclude (tag=San_Francisco)
• B. tag=Marketing NOT (tag=San_Francisco)
• C. tag::Marketing!=San_Francisco
• D. tag!=Marketing tag=San_Francisco

Which SPL query will group results that occur within 15 seconds of each other by user and host?

• A. index=firewall | transaction user host span=15s
• B. index=firewall | transaction user host maxspan=15s
• C. index=firewall | stats count by _time host user maxspan=15s
• D. index=firewall | stats count by _time host user span=15s

Which of the following commands will show the maximum bytes?

• A. sourcetype=access_* | avg (bytes)
• B. sourcetype=access_* | maximum totals by bytes
• C. sourcetype=access_* | max(bytes)
• D. sourcetype=access_* | stats max(bytes)

During the validation step of the Field Extractor workflow:
Select your answer.

• A. You can validate where the data originated from
• B. You can remove values that aren't a match for the field you want to define
• C. You cannot modify the field extraction