Assuming a standard time zone across the environment, what syntax will always return ewnts from between 2:00am and 5:00am?
Assuming a standard time zone across the environment, what syntax will always return ewnts from between 2:00am and 5:00am?
A . datehour>-2 AND date_hour<5
B . earliest=-2h@h AND latest=-5h@h
C . time_hour>-2 AND time_hour>-5
D . earliest=2h@ AND latest=5h3h
Answer: B
Explanation:
To always return events from between 2:00 AM and 5:00 AM, assuming a standard time zone across the environment, the correct Splunk search syntax is earliest=-2h@h AND latest=-5h@h (Option B). This syntax uses relative time modifiers to specify a range starting 2 hours ago from the current hour (-2h@h) and ending 5 hours ago from the current hour (-5h@h), effectively capturing the desired time window.
Latest SPLK-1004 Dumps Valid Version with 70 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
Subscribe
Login
0 Comments
Inline Feedbacks
View all comments