SPLK-1004 Exam Dumps : Splunk Core Certified Advanced Power User Exam

The correct way to exclude entries from the lookup file baditems.csv is using NOT [inputlookup baditems.csv]. This syntax excludes all entries in the lookup from the main search results.

When Splunk encounters repeating JSON data structures in an event, they are extracted as multivalue fields. These allow multiple values to be stored under a single field, which is common with arrays in JSON data.

The correct syntax to return events from between 2:00 AM and 5:00 AM is earliest=-2h@h AND latest=-5h@h. This uses relative time modifiers to specify a range starting at 2 AM and ending at 5 AM.