Splunk alerts can be based on search that run______. (Select all that apply.)

Splunk alerts can be based on search that run______. (Select all that apply.)
A . in real-time
B . on a regular schedule
C . and have no matching events

View Answer

Answer: A, B

Explanation:

Splunk alerts can be based on searches that run in real-time or on a regular schedule3. An alert is a way to monitor your data and get notified when certain conditions are met3. You can create an alert by specifying a search and a triggering condition3. You can also specify how often you want to run the search and how you want to receive the alert notifications3. You can run the alert search in real-time, which means that it continuously monitors your data as it streams into Splunk3. Alternatively, you can run the alert search on a regular schedule, which means that it runs at fixed intervals such as every hour or every day3. Therefore, options A and B are correct, while option C is incorrect because it is not a way to run an alert search.