SPLK-1002 Question #44: Real Exam Question with Answer & Explanation

Question

Select this in the fields sidebar to automatically pipe you search results to the rare command

Options

• Aevents with this field
• Brare values
• Ctop values by time
• Dtop values

Explanation

The fields sidebar is a panel that shows the fields that are present in your search results. The fields sidebar has two sections: selected fields and interesting fields. Selected fields are fields that you choose to display in your search results by clicking on them in the fields sidebar or by using the fields command. Interesting fields are fields that appear in at least 20 percent of events or have high variability among values. For each field in the fields sidebar, you can select one of the following options: events with this field, rare values, top values by time or top values. If you select rare values, Splunk will automatically pipe your search results to the rare command, which shows the least common values of a field. Therefore, option B is correct, while options A, C and D are incorrect because they do not pipe your search results to the rare command.

No community discussion yet for this question.