Which statement is true about Splunk alerts?

Question

Options

• AAlerts are based on searches that are either run on a scheduled interval or in real-time.
• BAlerts are based on searches and when triggered will only send an email notification.
• CAlerts are based on searches and require cron to run on scheduled interval.
• DAlerts are based on searches that are run exclusively as real-time.

• A
  74% (25)
• B
  3% (1)
• C
  9% (3)
• D
  15% (5)

Explanation

Option A is correct because Splunk alerts are fundamentally built on saved searches, and those searches can be configured to run either on a scheduled interval (every hour, daily, via cron-like scheduling built into Splunk itself) or in real-time (continuously monitoring incoming data) - both modes are supported natively.

Why the distractors are wrong:

• B is wrong because alerts support multiple actions beyond email: webhook calls, script execution, PagerDuty/Slack integrations, adding results to a lookup, and more.
• C is wrong because Splunk has its own internal scheduler - you don't need an external cron daemon; the scheduling is managed within Splunk's platform.
• D is wrong because real-time is only one of the two modes - scheduled interval is equally valid and far more common in practice.

Memory tip: Think of Splunk alerts as a saved search with a trigger - the search can "wake up" on a timer (scheduled) or never sleep (real-time). The alert action is flexible (not just email), and Splunk handles the scheduling itself (no external cron needed).

No community discussion yet for this question.