Splunk alerts can be based on search that run______. (Select all that apply.)

The correct answer is A. in real-time B. on a regular schedule. Splunk alerts can be triggered by two types of searches: real-time searches (continuously monitoring incoming data) and scheduled searches (running at defined intervals like every hour or daily). Option C ('have no matching events') describes a condition that CAN be used as an al

Creating and Using Reports and Alerts

Question

Options

Ain real-time
Bon a regular schedule
Cand have no matching events

How the community answered

(68 responses)

A
87% (59)
C
13% (9)

Explanation

Splunk alerts can be triggered by two types of searches: real-time searches (continuously monitoring incoming data) and scheduled searches (running at defined intervals like every hour or daily). Option C ('have no matching events') describes a condition that CAN be used as an alert trigger criterion, but it is not a search type-so it does not correctly answer what the search itself 'runs' as. The two fundamental modes are real-time and scheduled.

Topics

#Splunk alerts#Alert scheduling#Real-time alerts#Scheduled alerts

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice