Exam SPLK-1001 topic 1 question 7 discussion

Actual exam question from Splunk's SPLK-1001

Question #: 7
Topic #: 1

[All SPLK-1001 Questions]

Which of the following searches would return events with failure in index netfw or warn or critical in index netops?

A. (index=netfw failure) AND index=netops warn OR critical
B. (index=netfw failure) OR (index=netops (warn OR critical))
C. (index=netfw failure) AND (index=netops (warn OR critical))
D. (index=netfw failure) OR index=netops OR (warn OR critical)

Show Suggested Answer

Suggested Answer: B 🗳️

by mikelord at June 12, 2021, 4:27 p.m.

Comments

Submit Cancel

JokerRWild

8 months, 4 weeks ago

Selected Answer: B

This search uses the OR Boolean operator to search for events in either index=netfw with "failure" in it or in index=netops with "warn" or "critical" in it. The parentheses ensure that the warn and critical criteria are grouped together and only apply to the index=netops part of the search. The other options do not correctly group the criteria or use the AND operator incorrectly, which would not return the desired results.

upvoted 4 times

...