{"id":21697,"date":"2026-09-25T06:53:32","date_gmt":"2026-09-25T06:53:32","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=21697"},"modified":"2026-09-25T06:53:32","modified_gmt":"2026-09-25T06:53:32","slug":"splunk-splk-5002-practice-test-questions-and-exam-dumps-part-20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/splunk-splk-5002-practice-test-questions-and-exam-dumps-part-20-q381-400\/","title":{"rendered":"Splunk SPLK-5002 Practice Test Questions and Exam Dumps Part 20 Q381-400"},"content":{"rendered":"

View Full <\/b>Splunk SPLK-5002 Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 381. Which SPL command is used to combine the results of two searches by appending the second search’s results after the first search’s results?<\/b><\/p>\n

    \n
  1. <\/b> appendcols<\/span><\/li>\n
  2. <\/b> append<\/span><\/li>\n
  3. <\/b> join<\/span><\/li>\n
  4. <\/b> union<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2. append<\/b><\/p>\n

    Explanation :-<\/b><\/p>\n

    The <\/span>append<\/span> command adds the results returned by a subsearch to the results of the main search. It is useful when two searches produce similar fields but represent different sets of events or data that should appear together in one result set. For example, a search for current errors can be combined with another search for historical errors using <\/span>append<\/span>. Unlike <\/span>appendcols<\/span>, which combines results side by side based on row position, <\/span>append<\/span> places the subsearch results underneath the existing results. This makes <\/span>append<\/span> appropriate when the goal is to create one longer result set from two independent searches.<\/span><\/p>\n

    Question 382. An analyst wants to calculate the average response time for each host while retaining every original event. Which SPL command is most appropriate?<\/b><\/p>\n

      \n
    1. <\/b> eventstats<\/span><\/li>\n
    2. <\/b> stats<\/span><\/li>\n
    3. <\/b> chart<\/span><\/li>\n
    4. <\/b> timechart<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1. eventstats<\/b><\/p>\n

      Explanation :-<\/b><\/p>\n

      The <\/span>eventstats<\/span> command calculates statistical values and adds those values to the events from which they were calculated. For example, <\/span>eventstats avg(response_time) as avg_response by host<\/span> calculates the average response time for each host and places the corresponding average into the events for that host. This differs from <\/span>stats<\/span>, which transforms the event stream into a summary table and removes the individual events from the result. <\/span>eventstats<\/span> is therefore useful when an analyst needs aggregate information for comparison while still retaining the original event-level fields and records.<\/span><\/p>\n

      Question 383. Which SPL expression converts a multivalue field named <\/b>tags<\/b> into a single comma-separated string?<\/b><\/p>\n

        \n
      1. <\/b> mvexpand(tags)<\/span><\/li>\n
      2. <\/b> mvcount(tags)<\/span><\/li>\n
      3. <\/b> mvjoin(tags, “,”)<\/span><\/li>\n
      4. <\/b> split(tags, “,”)<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3. mvjoin(tags, “,”)<\/b><\/p>\n

        Explanation :-<\/b><\/p>\n

        The <\/span>mvjoin<\/span> function combines the values in a multivalue field into a single string using a specified delimiter. For example, <\/span>eval tag_list=mvjoin(tags, “,”)<\/span> converts values such as <\/span>web<\/span>, <\/span>production<\/span>, and <\/span>critical<\/span> into <\/span>web,production,critical<\/span>. This is different from <\/span>mvexpand<\/span>, which creates separate events for each multivalue element. <\/span>mvcount<\/span> returns the number of values, while <\/span>split<\/span> converts a single string into a multivalue field. Therefore, <\/span>mvjoin<\/span> is the appropriate function when the requirement is to represent multiple values as one delimited string.<\/span><\/p>\n

        Question 384. A Splunk administrator wants to extract a value from a JSON field called <\/b>payload<\/b>. Which command can directly parse structured JSON data?<\/b><\/p>\n

          \n
        1. <\/b> rex<\/span><\/li>\n
        2. <\/b> spath<\/span><\/li>\n
        3. <\/b> makemv<\/span><\/li>\n
        4. <\/b> replace<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2. spath<\/b><\/p>\n

          Explanation :-<\/b><\/p>\n

          The <\/span>spath<\/span> command is designed to extract information from structured data such as JSON and XML. If an event contains a JSON object in the <\/span>payload<\/span> field, <\/span>spath input=payload<\/span> can parse the structure and make fields available for further processing. <\/span>rex<\/span> can also extract values using regular expressions, but it is not specifically designed to understand JSON structure. <\/span>makemv<\/span> creates multivalue fields from delimited strings, and <\/span>replace<\/span> performs text replacement. Using <\/span>spath<\/span> is generally more appropriate when the source data already follows a structured JSON format.<\/span><\/p>\n

          Question 385. Which SPL command changes the order of events so that the last event becomes the first event?<\/b><\/p>\n

            \n
          1. <\/b> reverse<\/span><\/li>\n
          2. <\/b> sort<\/span><\/li>\n
          3. <\/b> tail<\/span><\/li>\n
          4. <\/b> transpose<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1. reverse<\/b><\/p>\n

            Explanation :-<\/b><\/p>\n

            The <\/span>reverse<\/span> command reverses the order of the events in the current result set. If the search results contain events in the order A, B, C, and D, applying <\/span>reverse<\/span> produces D, C, B, and A. This can be useful when the analyst needs to process or inspect results in the opposite order without changing the actual field values. <\/span>sort<\/span> orders results according to specified fields, while <\/span>tail<\/span> selects events from the end of the result set. <\/span>transpose<\/span> changes the orientation of a result table rather than reversing event order.<\/span><\/p>\n

            Question 386. An analyst wants to calculate the 95th percentile of <\/b>duration<\/b> for each application. Which SPL command should be used?<\/b><\/p>\n

              \n
            1. <\/b> stats p95(duration) by application<\/span><\/li>\n
            2. <\/b> stats max(duration) by application<\/span><\/li>\n
            3. <\/b> stats median(duration) by application<\/span><\/li>\n
            4. <\/b> stats avg(duration) by application<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1. stats p95(duration) by application<\/b><\/p>\n

              Explanation :-<\/b><\/p>\n

              The <\/span>p95()<\/span> statistical function calculates the 95th percentile of a numeric field. The SPL <\/span>stats p95(duration) by application<\/span> command calculates this value separately for every application. Percentiles are particularly useful for performance analysis because they show the value below which a specified percentage of observations fall. The maximum value can be heavily affected by a single extreme event, while an average may hide significant variations. The median represents the 50th percentile. Therefore, when the requirement specifically asks for the 95th percentile, <\/span>p95()<\/span> is the appropriate statistical function.<\/span><\/p>\n

              Question 387. Which SPL command can create a running count of events separately for each user?<\/b><\/p>\n

                \n
              1. <\/b> eventstats count by user<\/span><\/li>\n
              2. <\/b> stats count by user<\/span><\/li>\n
              3. <\/b> streamstats count by user<\/span><\/li>\n
              4. <\/b> chart count by user<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3. streamstats count by user<\/b><\/p>\n

                Explanation :-<\/b><\/p>\n

                The <\/span>streamstats<\/span> command calculates statistics incrementally as events are processed. Using <\/span>streamstats count by user<\/span> creates a running count for each user, so each event receives the current number of events encountered for that user. This is different from <\/span>stats<\/span>, which produces an aggregate summary after processing the complete result set. <\/span>eventstats<\/span> calculates an aggregate and adds it back to events but does not provide the same sequential running behavior. <\/span>streamstats<\/span> is therefore appropriate for questions involving cumulative or progressive calculations based on event order.<\/span><\/p>\n

                Question 388. A search contains a field named <\/b>status<\/b>. The analyst wants to return only events where the field exists, regardless of its value. Which search is appropriate?<\/b><\/p>\n

                  \n
                1. <\/b> status=””<\/span><\/li>\n
                2. <\/b> status=*<\/span><\/li>\n
                3. <\/b> status!=null<\/span><\/li>\n
                4. <\/b> status=exists<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2. status=<\/b>*<\/span><\/p>\n

                  Explanation :-<\/b><\/p>\n

                  In Splunk search syntax, <\/span>field=*<\/span> matches events where the specified field exists. Therefore, <\/span>status=*<\/span> returns events that contain a <\/span>status<\/span> field, regardless of the particular value stored in that field. This is useful when an analyst needs to determine whether a field was populated or extracted. An empty-string comparison does not reliably represent field existence, and <\/span>status=exists<\/span> is not the standard syntax for this purpose. Using <\/span>status=*<\/span> is the straightforward SPL approach for filtering events based on the presence of a field.<\/span><\/p>\n

                  Question 389. Which SPL function returns the number of values contained in a multivalue field?<\/b><\/p>\n

                    \n
                  1. <\/b> mvindex<\/span><\/li>\n
                  2. <\/b> mvjoin<\/span><\/li>\n
                  3. <\/b> mvfind<\/span><\/li>\n
                  4. <\/b> mvcount<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 4. mvcount<\/b><\/p>\n

                    Explanation :-<\/b><\/p>\n

                    The <\/span>mvcount<\/span> function returns the number of values contained in a multivalue field. For example, <\/span>eval tag_count=mvcount(tags)<\/span> creates a field containing the number of values stored in <\/span>tags<\/span>. This is useful when searches need to identify events containing many tags, addresses, users, or other multivalue data. <\/span>mvindex<\/span> retrieves one or more values at specified positions, <\/span>mvjoin<\/span> combines values into a single string, and <\/span>mvfind<\/span> searches for a matching value or pattern. Therefore, <\/span>mvcount<\/span> is the appropriate function when the requirement is to count multivalue elements.<\/span><\/p>\n

                    Question 390. An analyst needs to display the five most recent events after sorting by <\/b>_time<\/b> in descending order. Which SPL sequence is appropriate?<\/b><\/p>\n

                      \n
                    1. <\/b> head 5 | sort -_time<\/span><\/li>\n
                    2. <\/b> sort -_time | head 5<\/span><\/li>\n
                    3. <\/b> tail 5 | sort _time<\/span><\/li>\n
                    4. <\/b> sort _time | head 5<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2. <\/b>sort -_time | head 5<\/b><\/p>\n

                      Explanation :-<\/b><\/p>\n

                      The <\/span>sort -_time<\/span> command orders the results by <\/span>_time<\/span> in descending order, placing the newest events first. Applying <\/span>head 5<\/span> afterward keeps the first five events, which are therefore the five most recent events. The order of these commands matters because <\/span>head<\/span> operates on the current result order. If <\/span>head 5<\/span> were used first, it could select arbitrary or differently ordered events before the sorting operation. This pattern is useful when an analyst needs a specific number of the newest events based on their event timestamps.<\/span><\/p>\n

                      Question 391. Which SPL command is designed to replace values in fields according to specified replacement rules?<\/b><\/p>\n

                        \n
                      1. <\/b> replace<\/span><\/li>\n
                      2. <\/b> rename<\/span><\/li>\n
                      3. <\/b> rex<\/span><\/li>\n
                      4. <\/b> fields<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1. replace<\/b><\/p>\n

                        Explanation :-<\/b><\/p>\n

                        The <\/span>replace<\/span> command is used to replace specified field values with other values in search results. It is useful when an analyst needs to normalize or substitute values across result fields. For example, replacement rules can convert one representation of a value into another. <\/span>rename<\/span> changes field names rather than field values. <\/span>rex<\/span> is primarily used for extracting or modifying data using regular expressions, while <\/span>fields<\/span> controls which fields are retained or removed. Therefore, when the requirement specifically concerns replacing field values according to replacement rules, the <\/span>replace<\/span> command is appropriate.<\/span><\/p>\n

                        Question 392. An analyst wants to calculate total bytes transferred for each user by adding the <\/b>bytes_in<\/b> and <\/b>bytes_out<\/b> values for every event before aggregation. Which SPL approach is appropriate?<\/b><\/p>\n

                          \n
                        1. <\/b> stats sum(bytes_in + bytes_out) by user<\/span><\/li>\n
                        2. <\/b> eval total_bytes=bytes_in+bytes_out | stats sum(total_bytes) by user<\/span><\/li>\n
                        3. <\/b> stats bytes_in+bytes_out by user<\/span><\/li>\n
                        4. <\/b> eventstats bytes_in+bytes_out by user<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2. <\/b>eval total_bytes=bytes_in+bytes_out | stats sum(total_bytes) by user<\/b><\/p>\n

                          Explanation :-<\/b><\/p>\n

                          The <\/span>eval<\/span> command can calculate a per-event value before the results are aggregated. <\/span>eval total_bytes=bytes_in+bytes_out<\/span> creates the total transferred bytes for each event. The subsequent <\/span>stats sum(total_bytes) by user<\/span> then adds those event-level totals for each user. This two-stage approach makes the calculation explicit and allows the intermediate field to be reused later in the search. <\/span>eventstats<\/span> is intended to add aggregate statistics to events, while the other alternatives do not correctly express the required event-level calculation followed by aggregation.<\/span><\/p>\n

                          Question 393. Which SPL function returns the first non-null value from a list of arguments?<\/b><\/p>\n

                            \n
                          1. <\/b> coalesce<\/span><\/li>\n
                          2. <\/b> isnull<\/span><\/li>\n
                          3. <\/b> fillnull<\/span><\/li>\n
                          4. <\/b> null<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1. coalesce<\/b><\/p>\n

                            Explanation :-<\/b><\/p>\n

                            The <\/span>coalesce<\/span> function returns the first value in its argument list that is not null. For example, <\/span>eval user=coalesce(username, user, account)<\/span> can select the first available field value when different data sources use different field names. This is especially useful for normalizing fields across heterogeneous events. <\/span>isnull<\/span> checks whether a value is null, while <\/span>fillnull<\/span> is a command used to replace null field values with specified values. <\/span>coalesce<\/span> is therefore useful when multiple possible fields may contain the desired value and the search should select the first available one.<\/span><\/p>\n

                            Question 394. A search produces a table containing one row for each category and separate columns for status values. Which command can transform a two-dimensional result into a transposed table for easier display?<\/b><\/p>\n

                              \n
                            1. <\/b> untable<\/span><\/li>\n
                            2. <\/b> transpose<\/span><\/li>\n
                            3. <\/b> reverse<\/span><\/li>\n
                            4. <\/b> xyseries<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2. transpose<\/b><\/p>\n

                              Explanation :-<\/b><\/p>\n

                              The <\/span>transpose<\/span> command changes the orientation of a tabular result, turning columns into rows and rows into columns for display purposes. It is useful when a result table is easier to interpret in a transposed format, particularly when there are relatively few result rows but many columns. <\/span>untable<\/span> performs the opposite type of transformation by converting tabular data into a more normalized event-like format. <\/span>xyseries<\/span> constructs a table using values from specified fields, while <\/span>reverse<\/span> only reverses result order. Therefore, <\/span>transpose<\/span> is the command intended for this display transformation.<\/span><\/p>\n

                              Question 395. Which SPL function can extract a portion of a string based on a starting position and length?<\/b><\/p>\n

                                \n
                              1. <\/b> substr<\/span><\/li>\n
                              2. <\/b> replace<\/span><\/li>\n
                              3. <\/b> lower<\/span><\/li>\n
                              4. <\/b> mvindex<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1. substr<\/b><\/p>\n

                                Explanation :-<\/b><\/p>\n

                                The <\/span>substr<\/span> function extracts a portion of a string based on a starting position and, optionally, a length. It is useful when a field contains a fixed-format value and the analyst needs only a specific portion of it. For example, <\/span>eval prefix=substr(code,1,3)<\/span> can extract the first three characters of a string. <\/span>lower<\/span> changes alphabetic characters to lowercase, while <\/span>replace<\/span> substitutes matching text. <\/span>mvindex<\/span> works with multivalue fields rather than extracting character positions from ordinary strings. Therefore, <\/span>substr<\/span> is the appropriate function for character-based string extraction.<\/span><\/p>\n

                                Question 396. An analyst wants to count distinct source IP addresses for every destination host. Which SPL statement is appropriate?<\/b><\/p>\n

                                  \n
                                1. <\/b> stats count(source_ip) by destination_host<\/span><\/li>\n
                                2. <\/b> stats values(source_ip) by destination_host<\/span><\/li>\n
                                3. <\/b> stats dc(source_ip) by destination_host<\/span><\/li>\n
                                4. <\/b> stats list(source_ip) by destination_host<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 3. <\/b>stats dc(source_ip) by destination_host<\/b><\/p>\n

                                  Explanation :-<\/b><\/p>\n

                                  The <\/span>dc()<\/span> function calculates the distinct count of values in a field. Therefore, <\/span>stats dc(source_ip) by destination_host<\/span> returns the number of unique source IP addresses associated with each destination host. A regular <\/span>count(source_ip)<\/span> counts events containing the field and may count the same IP multiple times. <\/span>values(source_ip)<\/span> returns the unique values themselves, while <\/span>list(source_ip)<\/span> creates a multivalue list that can include duplicates. When the requirement is specifically the number of unique source addresses, <\/span>dc()<\/span> is the appropriate statistical function.<\/span><\/p>\n

                                  Question 397. Which SPL command can create time-based buckets from event timestamps before performing aggregation?<\/b><\/p>\n

                                    \n
                                  1. <\/b> bucket<\/span><\/li>\n
                                  2. <\/b> dedup<\/span><\/li>\n
                                  3. <\/b> fields<\/span><\/li>\n
                                  4. <\/b> rename<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1. bucket<\/b><\/p>\n

                                    Explanation :-<\/b><\/p>\n

                                    The <\/span>bucket<\/span> command discretizes numeric or time values into ranges. When applied to <\/span>_time<\/span>, it can create fixed time buckets such as five-minute intervals using syntax such as <\/span>bucket _time span=5m<\/span>. These buckets can then be used with commands such as <\/span>stats<\/span> to aggregate events over consistent periods. <\/span>timechart<\/span> can also perform time-based aggregation automatically, but <\/span>bucket<\/span> is specifically useful when the analyst wants to explicitly create the bucketed <\/span>_time<\/span> field and then use another aggregation command. The other listed commands do not perform time discretization.<\/span><\/p>\n

                                    Question 398. An analyst wants to calculate a cumulative sum of <\/b>bytes<\/b> as events are processed separately for each user. Which SPL command is appropriate?<\/b><\/p>\n

                                      \n
                                    1. <\/b> stats sum(bytes) by user<\/span><\/li>\n
                                    2. <\/b> eventstats sum(bytes) by user<\/span><\/li>\n
                                    3. <\/b> streamstats sum(bytes) as cumulative_bytes by user<\/span><\/li>\n
                                    4. <\/b> chart sum(bytes) by user<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 3. <\/b>streamstats sum(bytes) as cumulative_bytes by user<\/b><\/p>\n

                                      Explanation :-<\/b><\/p>\n

                                      The <\/span>streamstats<\/span> command calculates statistics incrementally as events are processed. Using <\/span>streamstats sum(bytes) as cumulative_bytes by user<\/span> creates a running total for each user, with each event showing the cumulative bytes observed for that user up to that point. <\/span>stats sum(bytes) by user<\/span> produces only a final aggregate for each user. <\/span>eventstats<\/span> adds aggregate values back to events but does not provide the same sequential cumulative behavior. <\/span>chart<\/span> is designed to generate tabular statistical summaries. Therefore, <\/span>streamstats<\/span> is appropriate for cumulative calculations based on event order.<\/span><\/p>\n

                                      Question 399. Which SPL command can filter events using a regular expression applied to a specific field?<\/b><\/p>\n

                                        \n
                                      1. <\/b> regex<\/span><\/li>\n
                                      2. <\/b> rex<\/span><\/li>\n
                                      3. <\/b> replace<\/span><\/li>\n
                                      4. <\/b> search<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1. regex<\/b><\/p>\n

                                        Explanation :-<\/b><\/p>\n

                                        The <\/span>regex<\/span> command filters search results based on whether field values match a specified regular expression. For example, <\/span>regex user=”^admin”<\/span> can retain events where the <\/span>user<\/span> field begins with <\/span>admin<\/span>. The <\/span>rex<\/span> command is commonly used to extract or manipulate field values using regular expressions rather than simply filtering events. <\/span>replace<\/span> performs value replacement, while <\/span>search<\/span> supports standard search expressions and wildcards. When the requirement specifically states that events should be filtered according to a regular-expression pattern applied to a field, the <\/span>regex<\/span> command is the appropriate choice.<\/span><\/p>\n

                                        Question 400. An analyst wants to display the number of events for each combination of <\/b>host<\/b> and <\/b>status<\/b>. Which SPL command is appropriate?<\/b><\/p>\n

                                          \n
                                        1. <\/b> stats count by host<\/span><\/li>\n
                                        2. <\/b> stats count by status<\/span><\/li>\n
                                        3. <\/b> stats count by host status<\/span><\/li>\n
                                        4. <\/b> stats dc(host) by status<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 3. <\/b>stats count by host status<\/b><\/p>\n

                                          Explanation :-<\/b><\/p>\n

                                          The <\/span>stats<\/span> command can group results by multiple fields. Using <\/span>stats count by host status<\/span> creates a separate result row for each unique combination of host and status and counts the events in that group. For example, the results can show separate counts for each host’s successful, failed, or pending events. Grouping only by <\/span>host<\/span> or only by <\/span>status<\/span> would lose one dimension of the requested breakdown. <\/span>dc(host) by status<\/span> instead calculates the number of distinct hosts for each status. Therefore, grouping by both fields directly satisfies the requirement.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Splunk SPLK-5002 Exam Dumps and Practice Test Dumps   Question 381. Which SPL command is used to combine the results of two searches by appending the second search’s results after the first search’s results? appendcols append join union Correct Answer: 2. append Explanation :- The append command adds the results returned by a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21697"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=21697"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21697\/revisions"}],"predecessor-version":[{"id":21698,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21697\/revisions\/21698"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=21697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=21697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=21697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}