In the Search and Reporting app, which is a default selected field?

The correct answer is C. _time. In the Search and Reporting app, _time is a default selected field. This means that it is always displayed in the events list and table views, unless explicitly deselected. Other default selected fields are host, source, and sourcetype. Index and action are not default selected…

Monitoring, logging, and remediation

Question

Options

Aindex
Baction
C_time
Dhost

How the community answered

(32 responses)

A
3% (1)
B
3% (1)
C
84% (27)
D
9% (3)

Explanation

In the Search and Reporting app, _time is a default selected field. This means that it is always displayed in the events list and table views, unless explicitly deselected. Other default selected fields are host, source, and sourcetype. Index and action are not default selected fields, but they can be added to the list of selected fields by clicking on All Fields.

Topics

#Splunk#default fields#_time#Search and Reporting app

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice