Which of the following describes this search? New Search 'third_party_outages(EMEA,-24h)'

The correct answer is C. This search will run the third_party_outages macro and pass the arguments EMEA and -24h to. This search will run the third_party_outages macro and pass the arguments EMEA and -24h to the macro definition. A search macro is a reusable chunk of SPL that can be inserted into other searches. A search macro can take arguments that are used to resolve the search string at…

Creating and Using Macros

Question

Options

AThis search will find all events for the third_party_outages event type that have "EMEA" or "-24h"
BThis search will run the third_party_outages saved search and filter for events containing "EMEA"
CThis search will run the third_party_outages macro and pass the arguments EMEA and -24h to
DThis search will find all events in the third_party_outages index with the tags EMEA and -24h.

How the community answered

(31 responses)

A
3% (1)
C
87% (27)
D
10% (3)

Explanation

This search will run the third_party_outages macro and pass the arguments EMEA and -24h to the macro definition. A search macro is a reusable chunk of SPL that can be inserted into other searches. A search macro can take arguments that are used to resolve the search string at execution time. The syntax for using a search macro is macro_name (argument1, argument2, ...).

Topics

#Splunk macros#search syntax#macro arguments#macro invocation

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice