Splunk
SPLK-3001 · Question #81
SPLK-3001 Question #81: Real Exam Question with Answer & Explanation
The correct answer is B. Run a | datamodel search, compare results to the CIM documentation for the datamodel.. https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
Question
Which of the following is a way to test for a property normalized data model?
Options
- AUse Audit -> Normalization Audit and check the Errors panel.
- BRun a | datamodel search, compare results to the CIM documentation for the datamodel.
- CRun a | loadjob search, look at tag values and compare them to known tags based on the
- DRun a | datamodel search and compare the results to the list of data models in the ES
Explanation
https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
Community Discussion
No community discussion yet for this question.