Which of the following searches can be used to define an event type?

The correct answer is C. index=games sourcetype=score player=* score>9999. Event types in Splunk must be defined using a plain, non-transforming search - no pipes, no transforming commands (like stats), and no subsearches are allowed. Option C is a straightforward keyword/field-filter search with no pipes, making it valid for an event type definition…

Creating Tags and Event Types

Question

Options

Aindex=games sourcetype=score [search index=players | fields player_id]
Bindex=games sourcetype=score I where score>9999
Cindex=games sourcetype=score player=* score>9999
Dindex=games sourcetype=score I stats count by player

How the community answered

(40 responses)

A
15% (6)
B
5% (2)
C
73% (29)
D
8% (3)

Explanation

Event types in Splunk must be defined using a plain, non-transforming search - no pipes, no transforming commands (like stats), and no subsearches are allowed. Option C is a straightforward keyword/field-filter search with no pipes, making it valid for an event type definition. Option A uses a subsearch (not allowed). Option D uses | stats (a transforming command, not allowed). Option B uses | where with a pipe, which is also not permitted in event type definitions.

Topics

#Event Types#SPL Syntax#Filtering Events#Basic Search Commands

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice