Splunk
SPLK-1001 · Question #175
Which of the following searches would return only events that match the following criteria? - Events are inside the main index - The field status exists in the event - The value in the status field…
The correct answer is C. index==main NOT status==200. See the full explanation below for the reasoning.
Question
Which of the following searches would return only events that match the following criteria?
- Events are inside the main index
- The field status exists in the event
- The value in the status field does not equal 200
Options
- Aindex==main status!==200
- Bindex=main NOT status=200
- Cindex==main NOT status==200
- Dindex-main status!=200
How the community answered
(32 responses)- A6% (2)
- B3% (1)
- C81% (26)
- D9% (3)
Community Discussion
No community discussion yet for this question.