Exam SPLK-1002 topic 1 question 180 discussion

Option Valid? Why A ❌ Wrong logic and unrelated to tags B ✅ Shows all SpecialProjectX-tagged events (including Support team) C ❌ Uses value Support as if it’s a field — invalid D ❌ Wrong syntax (- instead of =)

In Splunk, you can search for tagged events with a specific tag by specifying the field in the search query. tag::team-SpecialProjectX indicates you are searching for events tagged with the field team that has the value SpecialProjectX. This matches the events tagged for the SpecialProjectX project, specifically those related to the Support Team (team=support). Why not the other options? A. tag!=Fuji,Austin: This would exclude tags with the values Fuji and Austin, but it doesn't narrow down to SpecialProjectX or Support Team. It’s not specific enough for your need. B. tag=SpecialProjectX: While this would filter for all events tagged with SpecialProjectX, it doesn't filter for the Support Team specifically. It gives too broad of a result. C. tag::Support=SpecialProjectX Most Voted: This option doesn't fit the correct Splunk syntax. It's not properly formatted for filtering by tag and field-value pairs.

Question says search for events, not fields. Correct answer is B.

Search for specific tag alonside with specifilc field. C is the correct. It is asking for result SpecialProjectX events RELATED TO the Support Team - and there is such field. What search should Brad run to filter results for SpecialProjectX events related to the Support Team?