Which are valid ways to create an event type? (select all that apply)

The correct answer is C. By going to the Settings menu and clicking Event Types > New. D. By selecting an event in search results and clicking Event Actions > Build Event Type.. There are two supported ways to create an event type in Splunk. Option C is valid: navigate to Settings > Event Types > New Event Type to define one through the UI. Option D is valid: in search results, click on an event, select Event Actions > Build Event Type, which pre-populat

Creating Tags and Event Types

Question

Options

ABy using the searchtypes command in the search bar.
BBy editing the event_type stanza in the props.conf file.
CBy going to the Settings menu and clicking Event Types > New.
DBy selecting an event in search results and clicking Event Actions > Build Event Type.

How the community answered

(30 responses)

A
7% (2)
B
7% (2)
C
87% (26)

Explanation

There are two supported ways to create an event type in Splunk. Option C is valid: navigate to Settings > Event Types > New Event Type to define one through the UI. Option D is valid: in search results, click on an event, select Event Actions > Build Event Type, which pre-populates the search string for you. Option A is incorrect because there is no 'searchtypes' command in Splunk. Option B is incorrect because event types are stored in 'eventtypes.conf', not 'props.conf' (props.conf handles field extractions and source type configuration).

Topics

#Event Types#UI Configuration#Knowledge Objects

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice