Splunk
SPLK-2003 · Question #103
When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible?
Sign in or unlock SPLK-2003 to reveal the answer and full explanation for question #103. The question stem and answer options stay visible for context.
Ingesting and Handling Data
Question
When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible?
Options
- AInstall a second Splunk app and configure the query in the second app.
- BConfigure the second query in the Splunk App for SOAR Export.
- CEnter the two queries in the asset as comma separated values.
- DConfigure a second Splunk asset with the second query.
Unlock SPLK-2003 to see the answer
You've previewed enough free SPLK-2003 questions. Unlock SPLK-2003 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Splunk asset#on_poll#asset configuration#multi-query ingestion