Brad created a tag called "SpecialProjectX". It is associated with several field/value pairs, such as team=support, location=Austin, and release=Fuji. What search should Brad run to filter results…

The correct answer is B. tag::team=SpecialProjectX. The syntax tag::<fieldname>=<tagname> is used to search for events where a specific field has a given tag applied to it. tag::team=SpecialProjectX finds events where the team field value has been tagged with SpecialProjectX - which corresponds to the team=support field/value…

Creating Tags and Event Types

Question

Brad created a tag called "SpecialProjectX". It is associated with several field/value pairs, such as team=support, location=Austin, and release=Fuji. What search should Brad run to filter results for SpecialProjectX events related to the Support Team?

Options

Atag=SpecialProjectX
Btag::team=SpecialProjectX
Ctag::Support-SpecialProjectX
Dtag!=Fuji,Austin

How the community answered

(34 responses)

A
6% (2)
B
74% (25)
C
6% (2)
D
15% (5)

Explanation

The syntax tag::<fieldname>=<tagname> is used to search for events where a specific field has a given tag applied to it. tag::team=SpecialProjectX finds events where the team field value has been tagged with SpecialProjectX - which corresponds to the team=support field/value pair that has the SpecialProjectX tag. Option A (tag=SpecialProjectX) returns ALL events with that tag regardless of field, not just Support Team events. Options C and D use invalid syntax.

Topics

#Splunk Search Syntax#Tags#Field Association#Filtering Events

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice