Within a correlation search, dynamic field values can be specified with what syntax?

The correct answer is B. <fieldname /fieldname>. B is the correct answer because dynamic field values can be specified with <fieldname /fieldname> syntax within a correlation search. This syntax allows you to insert values from fields returned by the correlation search into alert actions such as email subject or body. For…

Anomaly Detection and Notable Events

Question

Options

Afieldname
B<fieldname /fieldname>
C%fieldname%
Deval(fieldname)

How the community answered

(61 responses)

A
2% (1)
B
92% (56)
C
5% (3)
D
2% (1)

Explanation

B is the correct answer because dynamic field values can be specified with <fieldname /fieldname> syntax within a correlation search. This syntax allows you to insert values from fields returned by the correlation search into alert actions such as email subject or body. For example, <host /host> inserts the value of the host field into the email.

Topics

#correlation search#dynamic fields#field syntax#field values

Community Discussion

No community discussion yet for this question.

Full SPLK-3002 Practice