Splunk - Using Fields Quiz Questions And Answers Rated A+

True or False: Once you rename a field, the new field name must be used in the rest of the search string. {Ans: TRUE}To remove fields from a search, you would use the _________ command. {Ans: fields -}The fields command allows you to do which of the following? Select all that apply. {Ans: Exclude Fields (fields -), Include fields (fields +), Include fields (fields)}True or False: Fields are knowledge objects. {Ans: True}In the Fields sidebar, Interesting Fields occur in at least ________ of resulting events. {Ans: 20%}At search time, _________ extracts fields from raw event data {Ans: fields extractor}Which of the following fields are default selected fields? {Ans: host, source, sourcetype}At search time, if an event has an equal(=) sign, the data to the left is treated as a ______ and the data to the right is treated as a ______. {Ans: field name, value}