Which of the following is a way to test for a property normalized data model?

Question

Options

• AUse Audit -> Normalization Audit and check the Errors panel.
• BRun a | datamodel search, compare results to the CIM documentation for the datamodel.
• CRun a | loadjob search, look at tag values and compare them to known tags based on the
• DRun a | datamodel search and compare the results to the list of data models in the ES

• A
  12% (7)
• B
  80% (47)
• C
  3% (2)
• D
  5% (3)

Explanation

https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime

No community discussion yet for this question.