{"id":22957,"date":"2026-09-26T09:56:57","date_gmt":"2026-09-26T09:56:57","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=22957"},"modified":"2026-09-26T09:56:57","modified_gmt":"2026-09-26T09:56:57","slug":"splunk-splk-1004-practice-test-questions-and-exam-dumps-part20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/splunk-splk-1004-practice-test-questions-and-exam-dumps-part20-q381-400\/","title":{"rendered":"Splunk SPLK-1004 Practice Test Questions and Exam Dumps Part20 Q381-400"},"content":{"rendered":"

View Full <\/b>Splunk SPLK-1004 Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 381.<\/b><\/p>\n

An analyst wants to calculate the total number of events for each <\/b>host<\/b>, but also wants to keep only hosts with more than 1,000 events. Which SPL is most appropriate?<\/b><\/p>\n

    \n
  1. <\/b> where count>1000 | stats count BY host<\/span>
    \n<\/span>2.<\/b> stats count AS event_count BY host | where event_count>1000<\/span>
    \n<\/span>3.<\/b> table host | where count>1000<\/span>
    \n<\/span>4.<\/b> dedup host | stats count<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    The event count must first be calculated before it can be filtered. <\/span>stats count AS event_count BY host<\/span> produces one row per host and creates the <\/span>event_count<\/span> field. The following <\/span>where event_count>1000<\/span> then removes hosts whose count does not meet the threshold. A <\/span>where<\/span> command cannot correctly evaluate an aggregate field before that field has been created. <\/span>table<\/span> does not perform aggregation, while <\/span>dedup host<\/span> would remove repeated host events before counting and therefore produce an incorrect result. This pattern\u2014aggregate first and filter the resulting metric afterward\u2014is common when building threshold-based reports in Splunk.<\/span><\/p>\n

    Question 382.<\/b><\/p>\n

    Which Splunk function should an analyst use to determine the number of unique users associated with each application?<\/b><\/p>\n

      \n
    1. <\/b> count()<\/span>
      \n<\/span>2.<\/b> values()<\/span>
      \n<\/span>3.<\/b> list()<\/span>
      \n<\/span>4.<\/b> dc()<\/span><\/li>\n<\/ol>\n

      Correct Answer: 4<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      The <\/span>dc()<\/span> function calculates a distinct count, which means duplicate values are counted only once. A search such as <\/span>stats dc(user) AS unique_users BY application<\/span> returns one row per application and reports how many different users were observed. <\/span>count(user)<\/span> would count every populated occurrence of the <\/span>user<\/span> field, including repeated events from the same user. <\/span>values(user)<\/span> would return the actual unique user names rather than only the number, while <\/span>list(user)<\/span> can preserve repeated values. When the requirement is specifically to calculate the number of unique values, <\/span>dc()<\/span> is the correct function.<\/span><\/p>\n

      Question 383.<\/b><\/p>\n

      Which Splunk command is designed to calculate aggregate statistics while preserving the original events and adding the calculated values back to them?<\/b><\/p>\n

        \n
      1. <\/b> eventstats<\/span>
        \n<\/span>2.<\/b> stats<\/span>
        \n<\/span>3.<\/b> chart<\/span>
        \n<\/span>4.<\/b> timechart<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        The <\/span>eventstats<\/span> command performs statistical calculations and adds the resulting values to each applicable original event. For example, <\/span>eventstats avg(duration) AS avg_duration BY application<\/span> calculates an average for each application and attaches that average to every event for the same application. This makes it possible to compare an individual event with its group-level average. The regular <\/span>stats<\/span> command would transform the event set into summarized rows, removing the original event-level detail. <\/span>chart<\/span> and <\/span>timechart<\/span> are also transforming commands. Therefore, <\/span>eventstats<\/span> is the appropriate choice when both individual events and aggregate context are required.<\/span><\/p>\n

        Question 384.<\/b><\/p>\n

        Which command is most appropriate for calculating a rolling average over the previous 20 results?<\/b><\/p>\n

          \n
        1. <\/b> stats<\/span>
          \n<\/span>2.<\/b> eventstats<\/span>
          \n<\/span>3.<\/b> streamstats<\/span>
          \n<\/span>4.<\/b> accum<\/span><\/li>\n<\/ol>\n

          Correct Answer: 3<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          The <\/span>streamstats<\/span> command calculates statistics incrementally as events move through the search pipeline. By specifying <\/span>window=20<\/span>, an analyst can compute a moving average over the current and preceding results within that window. This is useful for smoothing time-series values, identifying short-term trends, or comparing current behavior against recent activity. The result order matters, so the events should be sorted appropriately before the command is used. <\/span>stats<\/span> collapses results, <\/span>eventstats<\/span> attaches fixed aggregate values, and <\/span>accum<\/span> is primarily used for cumulative sums. For rolling-window calculations, <\/span>streamstats<\/span> provides the flexibility required.<\/span><\/p>\n

          Question 385.<\/b><\/p>\n

          Which Splunk function should be used to create a field containing <\/b>High<\/b>, <\/b>Medium<\/b>, or <\/b>Low<\/b> based on multiple thresholds?<\/b><\/p>\n

            \n
          1. <\/b> case()<\/span>
            \n<\/span>2.<\/b> coalesce()<\/span>
            \n<\/span>3.<\/b> split()<\/span>
            \n<\/span>4.<\/b> round()<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            The <\/span>case()<\/span> function evaluates multiple condition-value pairs in order and returns the value associated with the first condition that evaluates to true. This makes it well suited for classifications involving several thresholds. For example, values above 90 could be labeled <\/span>High<\/span>, values above 50 could be labeled <\/span>Medium<\/span>, and the remaining results could be labeled <\/span>Low<\/span>. Although nested <\/span>if()<\/span> functions can achieve the same result, they tend to become harder to read as the number of conditions grows. <\/span>coalesce()<\/span> deals with null values, while <\/span>split()<\/span> and <\/span>round()<\/span> perform unrelated transformations.<\/span><\/p>\n

            Question 386.<\/b><\/p>\n

            Which SPL function is most appropriate for returning the first non-null value from fields named <\/b>src_ip<\/b>, <\/b>client_ip<\/b>, and <\/b>source_address<\/b>?<\/b><\/p>\n

              \n
            1. <\/b> case()<\/span>
              \n<\/span>2.<\/b> coalesce()<\/span>
              \n<\/span>3.<\/b> values()<\/span>
              \n<\/span>4.<\/b> latest()<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              The <\/span>coalesce()<\/span> function checks its arguments from left to right and returns the first value that is not null. For example, <\/span>eval src=coalesce(src_ip,client_ip,source_address)<\/span> creates a normalized source address regardless of which original field name is populated. This is useful in environments where different sourcetypes represent the same concept with different field names. <\/span>case()<\/span> evaluates Boolean conditions, while <\/span>values()<\/span> and <\/span>latest()<\/span> are typically used in statistical aggregation. <\/span>coalesce()<\/span> is therefore the most direct way to normalize multiple possible fields into one consistent field during search time.<\/span><\/p>\n

              Question 387.<\/b><\/p>\n

              Which Splunk command filters results according to a regular expression and is primarily used for pattern-based event filtering rather than field extraction?<\/b><\/p>\n

                \n
              1. <\/b> rex<\/span>
                \n<\/span>2.<\/b> spath<\/span>
                \n<\/span>3.<\/b> regex<\/span>
                \n<\/span>4.<\/b> rename<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                The <\/span>regex<\/span> command filters search results based on whether a field or <\/span>_raw<\/span> matches a regular expression. This makes it appropriate when an analyst wants to retain or remove events according to a text pattern. The <\/span>rex<\/span> command also uses regular expressions, but its primary purposes are field extraction and text substitution. <\/span>spath<\/span> works with structured JSON or XML, while <\/span>rename<\/span> changes field names. Understanding the distinction between <\/span>regex<\/span> and <\/span>rex<\/span> is important because one is primarily a filtering command and the other is generally used to create or transform fields.<\/span><\/p>\n

                Question 388.<\/b><\/p>\n

                Which command should an analyst use to extract a new field from raw text using a named regular-expression capture group?<\/b><\/p>\n

                  \n
                1. <\/b> regex<\/span>
                  \n<\/span>2.<\/b> lookup<\/span>
                  \n<\/span>3.<\/b> spath<\/span>
                  \n<\/span>4.<\/b> rex<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 4<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  The <\/span>rex<\/span> command performs search-time field extraction using regular expressions. Named capture groups allow the matching part of <\/span>_raw<\/span> or another field to be stored as a new field for later analysis. For example, analysts can extract transaction IDs, usernames, response codes, or other patterns from unstructured events. The <\/span>regex<\/span> command is mainly used to filter results based on a pattern, while <\/span>spath<\/span> is intended for structured JSON or XML content. <\/span>lookup<\/span> enriches events with external reference data. When a field must be extracted from unstructured text with a regular expression, <\/span>rex<\/span> is the appropriate command.<\/span><\/p>\n

                  Question 389.<\/b><\/p>\n

                  Which Splunk command is most suitable for extracting nested values from JSON data stored in a field?<\/b><\/p>\n

                    \n
                  1. <\/b> spath<\/span>
                    \n<\/span>2.<\/b> rex<\/span>
                    \n<\/span>3.<\/b> transaction<\/span>
                    \n<\/span>4.<\/b> table<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    The <\/span>spath<\/span> command is designed specifically for structured data such as JSON and XML. It can navigate nested paths and extract selected values into fields that can then be used in filters, statistics, lookups, and reports. While <\/span>rex<\/span> could potentially extract some structured content using regular expressions, this is usually less reliable and harder to maintain than using the structure-aware <\/span>spath<\/span> command. <\/span>transaction<\/span> groups related events, and <\/span>table<\/span> only controls presentation. Therefore, when the event contains JSON or XML and a nested value needs to be extracted, <\/span>spath<\/span> is the preferred search-time tool.<\/span><\/p>\n

                    Question 390.<\/b><\/p>\n

                    Which Splunk command converts a delimited single-value field into a multivalue field?<\/b><\/p>\n

                      \n
                    1. <\/b> mvexpand<\/span>
                      \n<\/span>2.<\/b> makemv<\/span>
                      \n<\/span>3.<\/b> nomv<\/span>
                      \n<\/span>4.<\/b> append<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      The <\/span>makemv<\/span> command converts a field containing delimited text into a multivalue field. For example, a value such as <\/span>admin,user,auditor<\/span> can be separated into three values using the comma as the delimiter. Once the field becomes multivalue, functions such as <\/span>mvcount()<\/span>, <\/span>mvindex()<\/span>, and <\/span>mvjoin()<\/span> can be used, or <\/span>mvexpand<\/span> can convert the values into separate result rows. <\/span>nomv<\/span> performs the opposite general transformation by turning a multivalue field into a single-value representation. <\/span>append<\/span> combines result sets and is unrelated to multivalue conversion.<\/span><\/p>\n

                      Question 391.<\/b><\/p>\n

                      Which Splunk function should be used to return the number of elements in a multivalue field?<\/b><\/p>\n

                        \n
                      1. <\/b> count()<\/span>
                        \n<\/span>2.<\/b> dc()<\/span>
                        \n<\/span>3.<\/b> mvcount()<\/span>
                        \n<\/span>4.<\/b> values()<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 3<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        The <\/span>mvcount()<\/span> function returns the number of elements contained in a multivalue field for an individual result. For example, <\/span>eval group_count=mvcount(groups)<\/span> can determine how many groups are listed in the <\/span>groups<\/span> field for each event. This differs from <\/span>count()<\/span>, which is a statistical function used across multiple events, and from <\/span>dc()<\/span>, which counts distinct values in an aggregation group. <\/span>values()<\/span> returns the unique field values rather than the number of elements inside a multivalue field. When the analyst needs to inspect the size of a multivalue field within each event, <\/span>mvcount()<\/span> is the correct choice.<\/span><\/p>\n

                        Question 392.<\/b><\/p>\n

                        Which function can return the last value in a multivalue field using positional indexing?<\/b><\/p>\n

                          \n
                        1. <\/b> mvcount()<\/span>
                          \n<\/span>2.<\/b> mvjoin()<\/span>
                          \n<\/span>3.<\/b> split()<\/span>
                          \n<\/span>4.<\/b> mvindex()<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 4<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          The <\/span>mvindex()<\/span> function retrieves one or more elements from a multivalue field according to position. Negative indexes can reference elements from the end of the field, so an expression such as <\/span>mvindex(field,-1)<\/span> can retrieve the last value. This is useful when the order of multivalue values is meaningful and the analyst needs only one element. <\/span>mvcount()<\/span> returns the number of values, <\/span>mvjoin()<\/span> converts all values into one string, and <\/span>split()<\/span> converts a delimited string into a multivalue field. For positional access to multivalue data, <\/span>mvindex()<\/span> is the appropriate function.<\/span><\/p>\n

                          Question 393.<\/b><\/p>\n

                          Which command creates one result row for each value in a multivalue field?<\/b><\/p>\n

                            \n
                          1. <\/b> mvexpand<\/span>
                            \n<\/span>2.<\/b> makemv<\/span>
                            \n<\/span>3.<\/b> nomv<\/span>
                            \n<\/span>4.<\/b> split<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            The <\/span>mvexpand<\/span> command takes a multivalue field and creates a separate result for each value. The other fields from the original event are repeated for each newly generated row. This is useful when analysts want to count, filter, or group the individual elements independently. For example, one event containing three role values becomes three rows after applying <\/span>mvexpand roles<\/span>. <\/span>makemv<\/span> and <\/span>split()<\/span> create multivalue fields, while <\/span>nomv<\/span> converts a multivalue field into a single-value representation. Since expansion can dramatically increase result volume, analysts should use <\/span>mvexpand<\/span> carefully when working with large datasets.<\/span><\/p>\n

                            Question 394.<\/b><\/p>\n

                            Which Splunk function combines all values of a multivalue field into a single string separated by a specified delimiter?<\/b><\/p>\n

                              \n
                            1. <\/b> split()<\/span>
                              \n<\/span>2.<\/b> mvjoin()<\/span>
                              \n<\/span>3.<\/b> mvappend()<\/span>
                              \n<\/span>4.<\/b> mvindex()<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              The <\/span>mvjoin()<\/span> function converts a multivalue field into a single string using a delimiter supplied by the analyst. For example, <\/span>eval role_text=mvjoin(roles,”,”)<\/span> produces a comma-separated list of the values stored in the <\/span>roles<\/span> field. This is particularly useful for report display, export, or systems that expect a single string rather than a multivalue field. <\/span>split()<\/span> performs the opposite transformation by converting a delimited string into multiple values. <\/span>mvappend()<\/span> combines values into a larger multivalue field, and <\/span>mvindex()<\/span> retrieves selected elements. Therefore, <\/span>mvjoin()<\/span> is the correct function for joining multivalue elements into text.<\/span><\/p>\n

                              Question 395.<\/b><\/p>\n

                              Which Splunk command can read the contents of a lookup table and use those records as the initial search results?<\/b><\/p>\n

                                \n
                              1. <\/b> lookup<\/span>
                                \n<\/span>2.<\/b> outputlookup<\/span>
                                \n<\/span>3.<\/b> inputlookup<\/span>
                                \n<\/span>4.<\/b> appendlookup<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 3<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                The <\/span>inputlookup<\/span> command loads records directly from a lookup table and makes them the current search result set. This is useful when the analyst wants to inspect lookup data, filter it, summarize it, or compare it with another dataset. The <\/span>lookup<\/span> command instead enriches existing events by matching field values against a lookup. <\/span>outputlookup<\/span> writes current search results to a lookup table. <\/span>inputlookup<\/span> can therefore be considered a generating command because it can start the search pipeline from reference data rather than indexed events. It is frequently used for asset lists, user lists, allowlists, or other tabular reference information.<\/span><\/p>\n

                                Question 396.<\/b><\/p>\n

                                Which command should be used to save current search results into a lookup table?<\/b><\/p>\n

                                  \n
                                1. <\/b> collect<\/span>
                                  \n<\/span>2.<\/b> lookup<\/span>
                                  \n<\/span>3.<\/b> inputlookup<\/span>
                                  \n<\/span>4.<\/b> outputlookup<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 4<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  The <\/span>outputlookup<\/span> command writes the current tabular search results into a lookup table. This allows the data to be reused in future searches for enrichment, comparison, or reporting. Typical uses include maintaining reference lists, storing intermediate analysis results, and creating allowlists or classifications. Analysts should understand whether the command will overwrite, append to, or otherwise modify an existing lookup. The <\/span>inputlookup<\/span> command reads lookup content, while <\/span>lookup<\/span> enriches events based on matches. <\/span>collect<\/span> writes data into a Splunk index rather than a lookup. For persisting search results as lookup data, <\/span>outputlookup<\/span> is the correct command.<\/span><\/p>\n

                                  Question 397.<\/b><\/p>\n

                                  Which Splunk command can retrieve host, source, or sourcetype activity information from index metadata without searching all raw events?<\/b><\/p>\n

                                    \n
                                  1. <\/b> metadata<\/span>
                                    \n<\/span>2.<\/b> fieldsummary<\/span>
                                    \n<\/span>3.<\/b> tstats<\/span>
                                    \n<\/span>4.<\/b> chart<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    The <\/span>metadata<\/span> command retrieves information about indexed hosts, sources, or sourcetypes directly from index metadata. It can provide event counts and first or last activity times, making it useful for checking whether data sources are still reporting. Since the command can answer these specific questions without scanning all raw event contents, it can be efficient for ingestion health checks. <\/span>fieldsummary<\/span> describes arbitrary fields in an existing result set, while <\/span>tstats<\/span> performs indexed statistical queries. <\/span>chart<\/span> is a transforming command for aggregation. When the requirement is specifically to inspect host, source, or sourcetype metadata, <\/span>metadata<\/span> is the appropriate command.<\/span><\/p>\n

                                    Question 398.<\/b><\/p>\n

                                    Which Splunk command provides descriptive information about fields in the current result set, including distinct counts and sample values?<\/b><\/p>\n

                                      \n
                                    1. <\/b> metadata<\/span>
                                      \n<\/span>2.<\/b> fieldsummary<\/span>
                                      \n<\/span>3.<\/b> fields<\/span>
                                      \n<\/span>4.<\/b> table<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      The <\/span>fieldsummary<\/span> command is designed for exploratory analysis of fields present in the current result set. It can display information such as distinct counts, null counts, numerical properties, and sample values. This makes it useful when an analyst is unfamiliar with a sourcetype and wants to understand what fields are available before constructing more focused searches. <\/span>metadata<\/span> focuses only on index-level hosts, sources, and sourcetypes. <\/span>fields<\/span> controls which fields remain available, and <\/span>table<\/span> controls final presentation. For a broad field-level overview, <\/span>fieldsummary<\/span> provides the most useful built-in descriptive output.<\/span><\/p>\n

                                      Question 399.<\/b><\/p>\n

                                      Which Splunk knowledge object is best for storing reusable SPL logic that can accept arguments and be used by multiple searches?<\/b><\/p>\n

                                        \n
                                      1. <\/b> Event type<\/span>
                                        \n<\/span>2.<\/b> Field alias<\/span>
                                        \n<\/span>3.<\/b> Search macro<\/span>
                                        \n<\/span>4.<\/b> Calculated field<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        A search macro stores reusable SPL and can accept arguments, making it flexible for logic that needs to be repeated across multiple searches with different inputs. This helps reduce duplication and simplifies maintenance because a central macro definition can be updated rather than editing many individual reports or dashboards. Event types classify matching events, field aliases provide alternate field names, and calculated fields create reusable derived fields based on <\/span>eval<\/span> expressions. Although calculated fields also reduce repetition, they are specifically intended for field creation. When the requirement is reusable and potentially parameterized SPL logic, a search macro is the most appropriate knowledge object.<\/span><\/p>\n

                                        Question 400.<\/b><\/p>\n

                                        A dashboard repeatedly performs large statistical searches over an accelerated data model. Which approach is generally the best for performance when the required fields are available?<\/b><\/p>\n

                                          \n
                                        1. <\/b> Run unrestricted raw searches for every panel<\/span>
                                          \n<\/span>2.<\/b> Use <\/span>transaction<\/span> for all correlations<\/span>
                                          \n<\/span>3.<\/b> Use multiple nested <\/span>join<\/span> commands<\/span>
                                          \n<\/span>4.<\/b> Use <\/span>tstats<\/span> against the accelerated data model<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 4<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          The <\/span>tstats<\/span> command can query indexed fields and accelerated data-model summaries, which can make it significantly faster than conventional raw-event searches for compatible use cases. This is especially valuable in dashboards that run frequently or cover long historical time ranges. By working with optimized summaries, <\/span>tstats<\/span> can reduce the amount of event parsing and processing required. <\/span>transaction<\/span> and <\/span>join<\/span> are useful for specific analytical problems but can introduce substantial overhead on large datasets. Broad raw searches also consume more resources than necessary. When the required metrics and fields are present in an accelerated data model, <\/span>tstats<\/span> is generally one of the most efficient approaches for repeated statistical analysis.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Splunk SPLK-1004 Exam Dumps and Practice Test Dumps   Question 381. An analyst wants to calculate the total number of events for each host, but also wants to keep only hosts with more than 1,000 events. Which SPL is most appropriate? where count>1000 | stats count BY host 2. stats count AS event_count […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22957"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=22957"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22957\/revisions"}],"predecessor-version":[{"id":22958,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22957\/revisions\/22958"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=22957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=22957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=22957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}