Splunk
SPLK-2003 · Question #58
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible
Sign in or unlock SPLK-2003 to reveal the answer and full explanation for question #58. The question stem and answer options stay visible for context.
Ingesting and Handling Data
Question
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible
Options
- AEnter the two queries in the asset as comma separated values.
- BConfigure the second query in the Phantom app for Splunk.
- CInstall a second Splunk app and configure the query in the second app.
- DConfigure a second Splunk asset with the second query.
Unlock SPLK-2003 to see the answer
You've previewed enough free SPLK-2003 questions. Unlock SPLK-2003 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#on_poll#Splunk asset#multiple queries#data ingestion