SPLK-1001 · Question #192
What are Splunk alerts based on?
The correct answer is B. Searches. Splunk alerts are based on searches - specifically, saved searches that run on a schedule or in real time, triggering an action when the search results meet a defined condition (e.g., result count exceeds a threshold). A (Dashboards) is wrong: dashboards are visualization…
Question
What are Splunk alerts based on?
Options
- ADashboards
- BSearches
- CWebhooks
- DReports
How the community answered
(19 responses)- A16% (3)
- B74% (14)
- C5% (1)
- D5% (1)
Explanation
Splunk alerts are based on searches - specifically, saved searches that run on a schedule or in real time, triggering an action when the search results meet a defined condition (e.g., result count exceeds a threshold).
- A (Dashboards) is wrong: dashboards are visualization containers for panels and charts; they display data but don't drive alert logic.
- C (Webhooks) is wrong: webhooks are one of several actions an alert can take when triggered (e.g., sending an HTTP POST), not what the alert is based on.
- D (Reports) is wrong: reports are also saved searches, but they're designed for scheduled output and sharing - alerts are a distinct object type built on the search itself, not on a report.
Memory tip: Think of an alert as a "search with a trigger" - you write a search, set a condition, and Splunk watches it. No search = no alert.
Community Discussion
No community discussion yet for this question.