SPLK-1002 · Question #102
Which workflow uses field values to perform a secondary search?
The correct answer is C. Search. In Splunk, the Search workflow action type uses a field's value to construct and run a secondary search, allowing deeper investigation of specific events.
Question
Which workflow uses field values to perform a secondary search?
Options
- APOST
- BAction
- CSearch
- DSub-Search
How the community answered
(23 responses)- A4% (1)
- C91% (21)
- D4% (1)
Why each option
In Splunk, the Search workflow action type uses a field's value to construct and run a secondary search, allowing deeper investigation of specific events.
POST is a workflow action type that sends HTTP POST data to an external URI, not a secondary Splunk search.
Action is not a distinct workflow action type in Splunk; it describes workflow actions generally.
The Search workflow action is specifically designed to take field values from an event and inject them into a new Splunk search query, enabling users to pivot from one result into a follow-up search using those contextual field values.
Sub-Search is a Splunk search construct used within a main search query, not a workflow action type.
Concept tested: Splunk Search workflow action type behavior
Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Workflowactionsoverview
Topics
Community Discussion
No community discussion yet for this question.