nerdexam
Splunk

SPLK-2003 · Question #77

If two or more conditions apply to data in a filter block, which path is followed in the playbook?

The correct answer is A. All paths with matching conditions are followed in parallel. In a playbook filter block, all paths whose conditions match the incoming data are activated simultaneously - the filter doesn't stop at the first match or pick a winner, it fans out to every valid branch. This is why B ("only the last matching condition") and D ("only the…

Developing Playbooks

Question

If two or more conditions apply to data in a filter block, which path is followed in the playbook?

Options

  • AAll paths with matching conditions are followed in parallel.
  • BOnly the last matching condition will activate its path.
  • CAll matching paths will be followed, but the first path to reach the end block will terminate the
  • DOnly the first matching condition will activate its path.

How the community answered

(16 responses)
  • A
    81% (13)
  • B
    6% (1)
  • C
    13% (2)

Explanation

In a playbook filter block, all paths whose conditions match the incoming data are activated simultaneously - the filter doesn't stop at the first match or pick a winner, it fans out to every valid branch. This is why B ("only the last matching condition") and D ("only the first matching condition") are wrong: filter blocks have no concept of priority or ordering between conditions. Option C is wrong because no single path "terminates" the others - each matching path runs independently to completion; one finishing doesn't kill the rest. Think of a filter block like a traffic roundabout with multiple exits: a car (data) can take every exit that matches its destination, not just the first one it sees.

Memory tip: Filter = Fan-out. If you remember that filters spread data across all matching paths (rather than gating it to one), option A will always click.

Topics

#filter block#multiple conditions#parallel paths#playbook logic

Community Discussion

No community discussion yet for this question.

Full SPLK-2003 Practice