Which of the following can be saved as an event type?

The correct answer is B. index=server_494 sourcetype=BETA_718 code=889. Only option B (index=server_494 sourcetype=BETA_718 code=889) can be saved as an event type because it is a simple filtering search containing no pipe (|) commands. Splunk prohibits saving searches with transforming commands or certain pipeline operations as event types. Option A

Creating Tags and Event Types

Question

Options

Aindex=server sourcetype=BETA_718 code=UB9 | stats count by code
Bindex=server_494 sourcetype=BETA_718 code=889
Cindex=server_494 sourcetype=BETA_718 code=839 stats where code > 203
Dindex=server_494 sourcetype=BETA_718 code=839 | inputlookup append=t servercode.csv

How the community answered

(42 responses)

A
2% (1)
B
93% (39)
C
5% (2)

Explanation

Only option B (index=server_494 sourcetype=BETA_718 code=889) can be saved as an event type because it is a simple filtering search containing no pipe (|) commands. Splunk prohibits saving searches with transforming commands or certain pipeline operations as event types. Option A contains | stats count by code, option C contains a stats where command (though malformed), and option D contains | inputlookup append=t - all use pipe commands that disqualify them from being saved as event types.

Topics

#Event types#Splunk Search Language#Filtering searches

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice