Splunk - Core Power User Exam – DUMP questions with correct answers

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used? A. The regex can no longer be edited. B. The field being extracted will be required for all future events. C. The events without the required field will not display in searches. D. Only events with the required string will be included in the extraction. CORRECT ANSWER ANSWER: D Which of the following statements describe data model acceleration? (select all that apply) A.Root events cannot be accelerated. B.Accelerated data models cannot be edited. C.Private data models cannot be accelerated. D.You must have administrative permissions or the accelerate_dacamodel capability to accelerate a data model. CORRECT ANSWER ANSWER: BCD Which of the following are required to create a POST workflow action? A. Label, URI, search string. B. XMI attributes, URI, name. C. Label, URI, post arguments.