Which of the following can be saved as an event type?

The correct answer is C. index=server_485 sourcetype=BETA_726 code=917. Only option C (index=server_485 sourcetype=BETA_726 code=917) can be saved as an event type because it is a plain filtering search with no pipe (|) commands. Splunk requires that event types be based on searches without transforming commands or subsearches. Option A contains a su

Creating Tags and Event Types

Question

Options

Aindex=server_485 sourcetype=BETA_726 code=917 ['inputlookup append=t servercode.csv]
Bindex=server_485 sourcetype=BETA_726 code=917 | stats where code > 200
Cindex=server_485 sourcetype=BETA_726 code=917
Dindex=server_485 sourcetype=BETA_726 code=917 | stats count by code

How the community answered

(34 responses)

A
3% (1)
B
3% (1)
C
88% (30)
D
6% (2)

Explanation

Only option C (index=server_485 sourcetype=BETA_726 code=917) can be saved as an event type because it is a plain filtering search with no pipe (|) commands. Splunk requires that event types be based on searches without transforming commands or subsearches. Option A contains a subsearch (['inputlookup ...]), option B contains a stats command, and option D contains a stats command - all of which disqualify them from being saved as event types.

Topics

#event types#SPL syntax#search filtering

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice