Splunk SPLK-1001 Exam - Topic 10 Question 9 Discussion

Actual exam question for Splunk's SPLK-1001 exam

Question #: 9
Topic #: 10

What is the correct way to use a time range specifier in the search bar so that the search looks back 2 hours?

Alatest=-2h

Bearliest=-2h

Clatest=-2hour@d

Dearliest=-2hour@d
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Specifytimemodifiersinyoursearch

Show Suggested Answer

Suggested Answer: B

by Reena at May 06, 2022, 05:01 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Christiane

4 months ago

I agree with B, earliest makes more sense for looking back.

upvoted 0 times

...

Laticia

4 months ago

I’m not sure about that, isn’t it always latest?

upvoted 0 times

...

Rebecka

4 months ago

Wait, can it really be latest or earliest? Sounds confusing.

upvoted 0 times

...

Myra

4 months ago

Definitely A, latest=-2h is correct!

upvoted 0 times

...

Tyra

4 months ago

I think it's B, earliest=-2h.

upvoted 0 times

...

Helaine

5 months ago

I feel like I saw a question where using -2hour@d was mentioned, but that seems more like a date range than just hours.

upvoted 0 times

...

Roselle

5 months ago

I’m confused about the time formats; I thought it was always latest for recent searches, but now I’m second-guessing myself.

upvoted 0 times

...

Tamra

5 months ago

I remember practicing a question similar to this, and I think earliest=-2h was the right way to go for looking back in time.

upvoted 0 times

...

Dortha

5 months ago

I think the correct answer might be A, but I'm not entirely sure about the difference between latest and earliest.

upvoted 0 times

...

Juliann

5 months ago

I'm a little confused by this question. I'm not sure how fraud risk factors or violation red flags would affect employee rights. I'll have to review my notes on this topic.

upvoted 0 times

...

Stefany

5 months ago

Disk defragmentation could help, but that's more for improving performance, not necessarily fixing read/write errors. I'd go with chkdsk or disk cleanup first.

upvoted 0 times

...

Elbert

5 months ago

I'm pretty sure the primary purpose of Extended Analytics in FM is to export the data to a relational database. That seems like the most useful option for further analysis.

upvoted 0 times

...