Splunk
SPLK-3001 · Question #72
When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?
The correct answer is A. $fieldname$. This notation allows dynamic content to be included in the notable event, pulling directly from the fields within the event data itself.
Creating Correlation Searches
Question
When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?
Options
- A$fieldname$
- B"fieldname"
- C%fieldname%
- Dfieldname
How the community answered
(58 responses)- A86% (50)
- B9% (5)
- C3% (2)
- D2% (1)
Explanation
This notation allows dynamic content to be included in the notable event, pulling directly from the fields within the event data itself.
Topics
#notable events#field token syntax#correlation search#$fieldname$
Community Discussion
No community discussion yet for this question.