SPLK-1002 V4

Splunk alerts can be based on search that run______. (Select all that apply.)A . in real-timeB . on a regular scheduleC . and have no matching eventsView AnswerAnswer: A, B Explanation: Splunk alerts can be based on searches that run in real-time or on a regular schedule3. An alert is...

Which of the following searches will show the number of categoryld used by each host?A . Sourcetype=access_* |sum bytes by hostB . Sourcetype=access_* |stats sum(categorylD. by hostC . Sourcetype=access_* |sum(bytes) by hostD . Sourcetype=access_* |stats sum by hostView AnswerAnswer: B

To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?A . Index-main | REJECT trans sessionidB . Index-main | transaction sessionid | search REJECTC . Index=main | transaction sessionid | whose transaction=rejectD . Index=main | transaction sessionid | where...