{"id":22951,"date":"2026-09-26T09:56:10","date_gmt":"2026-09-26T09:56:10","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=22951"},"modified":"2026-09-26T09:56:10","modified_gmt":"2026-09-26T09:56:10","slug":"splunk-splk-1004-practice-test-questions-and-exam-dumps-part17-q321-340","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/splunk-splk-1004-practice-test-questions-and-exam-dumps-part17-q321-340\/","title":{"rendered":"Splunk SPLK-1004 Practice Test Questions and Exam Dumps Part17 Q321-340"},"content":{"rendered":"

View Full <\/b>Splunk SPLK-1004 Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 321.<\/b><\/p>\n

An analyst wants to identify the most recently observed value of <\/b>status<\/b> for each <\/b>host<\/b>. Which SPL is most appropriate?<\/b><\/p>\n

    \n
  1. <\/b> stats latest(status) AS latest_status BY host<\/span>
    \n<\/span>2.<\/b> stats max(status) AS latest_status BY host<\/span>
    \n<\/span>3.<\/b> dedup host status<\/span>
    \n<\/span>4.<\/b> sort – status BY host<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    The <\/span>latest()<\/span> statistical function returns the field value associated with the most recent event according to event time. Therefore, <\/span>stats latest(status) AS latest_status BY host<\/span> produces one row per host showing the most recently observed status. This is different from <\/span>max(status)<\/span>, which returns the greatest value rather than the most recent one. <\/span>dedup<\/span> can retain a single event per host depending on result order, but it is less explicit for this requirement and may discard other useful information. <\/span>latest()<\/span> is purpose-built for time-aware aggregation and is especially useful when tracking the most recent state of systems, users, applications, or other entities.<\/span><\/p>\n

    Question 322.<\/b><\/p>\n

    Which Splunk function should be used to return the value of a field associated with the earliest event in each group?<\/b><\/p>\n

      \n
    1. <\/b> min()<\/span>
      \n<\/span>2.<\/b> earliest()<\/span>
      \n<\/span>3.<\/b> first()<\/span>
      \n<\/span>4.<\/b> initial()<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      The <\/span>earliest()<\/span> function returns the value associated with the earliest event time in the aggregation group. This is useful when an analyst wants to determine the first known state, first observed user, or initial action associated with an entity. It should not be confused with <\/span>min()<\/span>, which returns the smallest value regardless of time. For example, the alphabetically smallest status may not be the first status that occurred. In time-based investigations, understanding the difference between chronological functions such as <\/span>earliest()<\/span> and value-based functions such as <\/span>min()<\/span> is essential for producing correct results.<\/span><\/p>\n

      Question 323.<\/b><\/p>\n

      Which command is most suitable for calculating a statistical summary by two dimensions, with one field arranged across columns?<\/b><\/p>\n

        \n
      1. <\/b> stats<\/span>
        \n<\/span>2.<\/b> timechart<\/span>
        \n<\/span>3.<\/b> chart<\/span>
        \n<\/span>4.<\/b> fields<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        The <\/span>chart<\/span> command is designed to produce aggregated, cross-tabulated results where one field can define rows and another can define columns. For example, an analyst might count events by <\/span>host<\/span> and <\/span>status<\/span>, with status values becoming separate columns. This makes <\/span>chart<\/span> particularly useful for reports and visualizations that compare categories across another grouping field. The <\/span>stats<\/span> command can also perform multi-field aggregation, but its output is typically row-oriented rather than cross-tabulated. <\/span>timechart<\/span> specifically uses time as the primary dimension, while <\/span>fields<\/span> only controls field visibility. When a matrix-like structure is required, <\/span>chart<\/span> is often the most convenient command.<\/span><\/p>\n

        Question 324.<\/b><\/p>\n

        Which Splunk command is most appropriate for creating a time series of event counts separated by <\/b>sourcetype<\/b>?<\/b><\/p>\n

          \n
        1. <\/b> stats count BY sourcetype<\/span>
          \n<\/span>2.<\/b> chart count BY sourcetype<\/span>
          \n<\/span>3.<\/b> top sourcetype<\/span>
          \n<\/span>4.<\/b> timechart count BY sourcetype<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          The <\/span>timechart<\/span> command automatically organizes statistical results over <\/span>_time<\/span>, making it ideal for trend analysis. The search <\/span>timechart count BY sourcetype<\/span> creates a time series showing event counts for each sourcetype over the selected time range. This can help identify changes in data volume, missing feeds, or unusual spikes. <\/span>stats count BY sourcetype<\/span> would summarize counts by sourcetype but would not show how those counts change over time. <\/span>chart<\/span> is useful for categorical comparisons, while <\/span>top<\/span> ranks by frequency. For time-based trend visualization, <\/span>timechart<\/span> is the correct choice.<\/span><\/p>\n

          Question 325.<\/b><\/p>\n

          Which function is most appropriate for calculating the average of a numeric field such as <\/b>duration<\/b>?<\/b><\/p>\n

            \n
          1. <\/b> avg()<\/span>
            \n<\/span>2.<\/b> meanvalue()<\/span>
            \n<\/span>3.<\/b> median()<\/span>
            \n<\/span>4.<\/b> sum()<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            The <\/span>avg()<\/span> function calculates the arithmetic mean of numeric field values. For example, <\/span>stats avg(duration) BY application<\/span> returns the average duration for each application. Average values are commonly used to compare performance or establish baseline behavior. However, analysts should remember that averages can be heavily influenced by extreme values. In some scenarios, median or percentile metrics may better represent typical performance. <\/span>median()<\/span> returns the middle value, while <\/span>sum()<\/span> adds all values together. For a standard arithmetic mean, <\/span>avg()<\/span> is the correct statistical function in SPL.<\/span><\/p>\n

            Question 326.<\/b><\/p>\n

            Which function returns the middle value of a numeric distribution and can be less affected by extreme outliers than an average?<\/b><\/p>\n

              \n
            1. <\/b> range()<\/span>
              \n<\/span>2.<\/b> median()<\/span>
              \n<\/span>3.<\/b> stdev()<\/span>
              \n<\/span>4.<\/b> max()<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              The <\/span>median()<\/span> function returns the middle value when the observations are ordered. It can provide a more representative measure of typical behavior when a dataset contains extreme values that would distort the arithmetic mean. For example, a few very slow requests may raise the average response time substantially even when most requests are fast. Median helps show the central value without giving extreme observations as much influence. <\/span>range()<\/span> measures the difference between maximum and minimum values, <\/span>stdev()<\/span> measures dispersion, and <\/span>max()<\/span> returns the highest value. Median is therefore especially useful for skewed performance or duration data.<\/span><\/p>\n

              Question 327.<\/b><\/p>\n

              Which Splunk function is used to calculate standard deviation for a numeric field?<\/b><\/p>\n

                \n
              1. <\/b> variance()<\/span>
                \n<\/span>2.<\/b> range()<\/span>
                \n<\/span>3.<\/b> stdev()<\/span>
                \n<\/span>4.<\/b> deviation()<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                The <\/span>stdev()<\/span> function calculates the standard deviation of numeric values. Standard deviation measures how much the values tend to vary around the mean. A low standard deviation indicates values are relatively tightly clustered, while a high standard deviation suggests more variability. This can be useful when evaluating consistency in response times, transaction sizes, resource usage, or other numeric measurements. It provides more information than simply looking at the average because two datasets can have the same average but very different spreads. <\/span>range()<\/span> only measures the distance between the minimum and maximum values, while variance represents a related but differently scaled measure of dispersion.<\/span><\/p>\n

                Question 328.<\/b><\/p>\n

                Which Splunk statistical function returns the variance of a numeric field?<\/b><\/p>\n

                  \n
                1. <\/b> stdev()<\/span>
                  \n<\/span>2.<\/b> range()<\/span>
                  \n<\/span>3.<\/b> spread()<\/span>
                  \n<\/span>4.<\/b> var()<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 4<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  The <\/span>var()<\/span> function calculates variance for a numeric field. Variance measures how widely the observations are dispersed around their mean. It is closely related to standard deviation, with standard deviation being the square root of variance. Although standard deviation is often easier to interpret because it uses the same units as the original field, variance remains useful in statistical calculations and comparisons. The <\/span>range()<\/span> function only measures the difference between the largest and smallest values, while <\/span>stdev()<\/span> returns standard deviation rather than variance. Therefore, <\/span>var()<\/span> is the correct function when the requirement specifically asks for variance.<\/span><\/p>\n

                  Question 329.<\/b><\/p>\n

                  Which command is most appropriate for grouping <\/b>_time<\/b> into 15-minute intervals before using <\/b>stats<\/b>?<\/b><\/p>\n

                    \n
                  1. <\/b> bin _time span=15m<\/span>
                    \n<\/span>2.<\/b> sort _time span=15m<\/span>
                    \n<\/span>3.<\/b> table _time span=15m<\/span>
                    \n<\/span>4.<\/b> dedup _time span=15m<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    The <\/span>bin<\/span> command groups continuous numeric or time values into discrete buckets. Using <\/span>bin _time span=15m<\/span> rounds or groups event timestamps into 15-minute intervals, allowing subsequent commands such as <\/span>stats<\/span> to summarize events within those periods. This is particularly useful when an analyst wants custom time aggregation without using <\/span>timechart<\/span>. The <\/span>sort<\/span> command only changes result order, <\/span>table<\/span> controls presentation, and <\/span>dedup<\/span> removes duplicate values. Because <\/span>bin<\/span> prepares time values for grouped statistical analysis, it is the appropriate command for creating regular time buckets.<\/span><\/p>\n

                    Question 330.<\/b><\/p>\n

                    Which Splunk command can be used to replace an existing field value such as <\/b>unknown<\/b> with <\/b>unclassified<\/b> in search results?<\/b><\/p>\n

                      \n
                    1. <\/b> fillnull<\/span>
                      \n<\/span>2.<\/b> replace<\/span>
                      \n<\/span>3.<\/b> rename<\/span>
                      \n<\/span>4.<\/b> fields<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      The <\/span>replace<\/span> command substitutes matching field values with new values in the current search results. For example, it can change occurrences of <\/span>unknown<\/span> to <\/span>unclassified<\/span> within a specified field. This is useful for normalizing labels, simplifying categories, or improving presentation without modifying the indexed events. <\/span>fillnull<\/span> is designed specifically for null or missing values rather than existing values. <\/span>rename<\/span> changes the field name, not the field content, and <\/span>fields<\/span> only controls which fields remain available. Therefore, <\/span>replace<\/span> is the direct command for substituting known field values in search-time results.<\/span><\/p>\n

                      Question 331.<\/b><\/p>\n

                      Which Splunk command can summarize the number of events by field values and retain only the least frequent values?<\/b><\/p>\n

                        \n
                      1. <\/b> top<\/span>
                        \n<\/span>2.<\/b> stats<\/span>
                        \n<\/span>3.<\/b> rare<\/span>
                        \n<\/span>4.<\/b> dedup<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 3<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        The <\/span>rare<\/span> command identifies the least frequently occurring values of a field and usually includes count and percentage information. It is useful for spotting uncommon values that may deserve further investigation, such as rare hosts, applications, user agents, process names, or destination domains. The <\/span>top<\/span> command does the opposite and returns the most frequent values. <\/span>stats<\/span> can be used to construct equivalent logic manually, but <\/span>rare<\/span> provides a concise built-in method for this specific type of frequency analysis. <\/span>dedup<\/span> merely removes repeated values and does not calculate how often each value occurred.<\/span><\/p>\n

                        Question 332.<\/b><\/p>\n

                        Which command can create one result per unique combination of fields while also calculating one or more aggregate values?<\/b><\/p>\n

                          \n
                        1. <\/b> dedup<\/span>
                          \n<\/span>2.<\/b> table<\/span>
                          \n<\/span>3.<\/b> fields<\/span>
                          \n<\/span>4.<\/b> stats<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 4<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          The <\/span>stats<\/span> command can group events by one or more fields and calculate aggregate functions for every unique combination. For example, <\/span>stats count sum(bytes) BY host user<\/span> produces one row for every unique host-and-user pair with both an event count and total bytes. This is more informative than <\/span>dedup<\/span>, which would retain only one representative event per combination. <\/span>table<\/span> displays fields without aggregation, while <\/span>fields<\/span> controls field availability. <\/span>stats<\/span> is one of the core SPL commands because it can simultaneously reduce event-level data into meaningful grouped metrics and support multiple statistical calculations in a single search.<\/span><\/p>\n

                          Question 333.<\/b><\/p>\n

                          An analyst needs to normalize usernames stored with inconsistent capitalization. Which SPL function should be used to convert all usernames to lowercase?<\/b><\/p>\n

                            \n
                          1. <\/b> lower()<\/span>
                            \n<\/span>2.<\/b> trim()<\/span>
                            \n<\/span>3.<\/b> tostring()<\/span>
                            \n<\/span>4.<\/b> replace()<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            The <\/span>lower()<\/span> function converts alphabetic characters to lowercase. An expression such as <\/span>eval normalized_user=lower(user)<\/span> can normalize values like <\/span>ADMIN<\/span>, <\/span>Admin<\/span>, and <\/span>admin<\/span> into a consistent representation. This is helpful before grouping, counting, deduplicating, or matching values against lookups because differences in capitalization can otherwise make logically identical values appear distinct. <\/span>trim()<\/span> removes leading and trailing whitespace, while <\/span>tostring()<\/span> converts a value into string form. <\/span>replace()<\/span> performs pattern-based substitution. For capitalization normalization, <\/span>lower()<\/span> is the appropriate and simplest function.<\/span><\/p>\n

                            Question 334.<\/b><\/p>\n

                            Which function should be used to remove leading and trailing whitespace from a field before lookup matching?<\/b><\/p>\n

                              \n
                            1. <\/b> lower()<\/span>
                              \n<\/span>2.<\/b> trim()<\/span>
                              \n<\/span>3.<\/b> substr()<\/span>
                              \n<\/span>4.<\/b> split()<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              The <\/span>trim()<\/span> function removes whitespace from both the beginning and end of a string. This can be very important before lookup matching because an extra leading or trailing space can prevent two otherwise identical values from matching correctly. For example, <\/span>“server01 “<\/span> and <\/span>“server01”<\/span> may be treated as different strings unless the value is normalized. <\/span>lower()<\/span> changes capitalization, <\/span>substr()<\/span> extracts part of a string based on position, and <\/span>split()<\/span> converts a delimited string into a multivalue field. <\/span>trim()<\/span> directly addresses unwanted surrounding whitespace and is therefore the appropriate function.<\/span><\/p>\n

                              Question 335.<\/b><\/p>\n

                              Which Splunk function should be used to return a portion of a string based on a known starting position and length?<\/b><\/p>\n

                                \n
                              1. <\/b> replace()<\/span>
                                \n<\/span>2.<\/b> split()<\/span>
                                \n<\/span>3.<\/b> substr()<\/span>
                                \n<\/span>4.<\/b> match()<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 3<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                The <\/span>substr()<\/span> function extracts part of a string using a starting position and optional length. It is well suited to fields with predictable fixed-position structures, such as account prefixes, coded identifiers, or specific portions of longer values. For example, an analyst might extract the first several characters of a device identifier into a new field. If the desired content does not appear in a fixed position, regular-expression extraction with <\/span>rex<\/span> may be more appropriate. <\/span>replace()<\/span> changes matched content, <\/span>split()<\/span> divides strings into multiple values, and <\/span>match()<\/span> tests regular expressions. Therefore, <\/span>substr()<\/span> is the correct function for positional substring extraction.<\/span><\/p>\n

                                Question 336.<\/b><\/p>\n

                                Which Splunk command can retrieve results from a previously completed search job using its search ID?<\/b><\/p>\n

                                  \n
                                1. <\/b> history<\/span>
                                  \n<\/span>2.<\/b> metadata<\/span>
                                  \n<\/span>3.<\/b> collect<\/span>
                                  \n<\/span>4.<\/b> loadjob<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 4<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  The <\/span>loadjob<\/span> command loads the results from a previously completed search job when its search ID is known and the job is still retained. This can be useful when an expensive search has already run and analysts want to reuse the results rather than execute the same search again. Access depends on permissions and on whether the job has expired according to retention settings. <\/span>metadata<\/span> retrieves index metadata, while <\/span>collect<\/span> stores search results into an index. Reusing an existing search job can save processing resources and support workflows where several subsequent analyses depend on the same expensive base result set.<\/span><\/p>\n

                                  Question 337.<\/b><\/p>\n

                                  Which Splunk command can be used to write results into a summary index for faster future reporting?<\/b><\/p>\n

                                    \n
                                  1. <\/b> collect<\/span>
                                    \n<\/span>2.<\/b> outputlookup<\/span>
                                    \n<\/span>3.<\/b> inputlookup<\/span>
                                    \n<\/span>4.<\/b> append<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    The <\/span>collect<\/span> command writes search results into a Splunk index and is commonly used with summary indexing. Summary indexing allows expensive searches to run on a schedule and save reduced, precomputed results that can later be searched much more efficiently. This is particularly valuable for long historical time ranges or dashboards that repeatedly perform the same calculations. <\/span>outputlookup<\/span> writes results into a lookup table rather than an index, while <\/span>inputlookup<\/span> reads lookup data. <\/span>append<\/span> only combines search results and does not persist them. Summary indexing requires thoughtful design so the saved fields, timestamps, and aggregation levels support the downstream reports that depend on them.<\/span><\/p>\n

                                    Question 338.<\/b><\/p>\n

                                    Which Splunk knowledge object is designed to create a derived field automatically from an <\/b>eval<\/b> expression during search time?<\/b><\/p>\n

                                      \n
                                    1. <\/b> Search macro<\/span>
                                      \n<\/span>2.<\/b> Calculated field<\/span>
                                      \n<\/span>3.<\/b> Event type<\/span>
                                      \n<\/span>4.<\/b> Tag<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      A calculated field is a knowledge object that automatically evaluates an expression at search time to create a derived field. This is useful when the same calculation is needed repeatedly across searches using a particular type of data. Instead of manually adding the same <\/span>eval<\/span> expression each time, administrators or power users can define the calculated field once and make it available according to its scope. Search macros encapsulate reusable SPL more broadly, event types classify matching events, and tags provide labels. A calculated field is the most natural choice when the requirement is specifically to make a reusable derived field available automatically during search processing.<\/span><\/p>\n

                                      Question 339.<\/b><\/p>\n

                                      Which Splunk feature is most appropriate for organizing standardized datasets and supporting Pivot-based analysis?<\/b><\/p>\n

                                        \n
                                      1. <\/b> Workflow action<\/span>
                                        \n<\/span>2.<\/b> Tag<\/span>
                                        \n<\/span>3.<\/b> Data model<\/span>
                                        \n<\/span>4.<\/b> Search history<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        A data model organizes related datasets, fields, constraints, and hierarchical relationships into a reusable analytical structure. It provides a standardized way to represent data for consistent analysis across users and applications. Pivot can use data models to let users build tables and visualizations without manually writing SPL. Data models can also be accelerated, allowing supported searches to use optimized summaries for improved performance. Workflow actions provide contextual links or searches, tags label field-value pairs, and search history records previous search activity. For structured reusable analytical datasets and Pivot support, a data model is the correct Splunk feature.<\/span><\/p>\n

                                        Question 340.<\/b><\/p>\n

                                        A Splunk environment has an accelerated data model that contains all fields needed for a frequently run dashboard search. Which approach will generally provide the best performance?<\/b><\/p>\n

                                          \n
                                        1. <\/b> Search all raw indexes using broad wildcards<\/span>
                                          \n<\/span>2.<\/b> Use <\/span>transaction<\/span> over the entire time range<\/span>
                                          \n<\/span>3.<\/b> Use several nested subsearches and joins<\/span>
                                          \n<\/span>4.<\/b> Use <\/span>tstats<\/span> against the accelerated data model<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 4<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          The <\/span>tstats<\/span> command can query indexed fields and accelerated data-model summaries without repeatedly retrieving and parsing all underlying raw events. When an accelerated data model contains all the required fields, <\/span>tstats<\/span> can provide substantial performance benefits for dashboards, reports, and other frequently executed searches. This is especially valuable across long historical ranges or high-volume datasets. Broad wildcard searches can consume unnecessary resources, while <\/span>transaction<\/span>, joins, and nested subsearches may add significant overhead. <\/span>tstats<\/span> is not suitable for every analytical problem, but when an accelerated model contains the necessary fields and metrics, it is generally one of the most efficient search approaches available in Splunk.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Splunk SPLK-1004 Exam Dumps and Practice Test Dumps   Question 321. An analyst wants to identify the most recently observed value of status for each host. Which SPL is most appropriate? stats latest(status) AS latest_status BY host 2. stats max(status) AS latest_status BY host 3. dedup host status 4. sort – status BY […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22951"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=22951"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22951\/revisions"}],"predecessor-version":[{"id":22952,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22951\/revisions\/22952"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=22951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=22951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=22951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}