Free Preparation Discussions
MENU
Splunk SPLK-1001 Exam - Topic 2 Question 108 Discussion
Topic #: 2
A collection of items containing things such as data inputs, UI elements, and knowledge objects is known as what?
The search query index=myindex source=c: mydata. txt NOT error=* specifies three criteria for the events to be returned:
The index must be myindex, which is a user-defined index that contains the data from a specific source or sources.
The source must be c: mydata. txt, which is the name of the file or directory where the data came from.
The error field must not exist in the events, which is indicated by the NOT operator and the wildcard character (*).
The NOT operator negates the following expression, which means that it returns the events that do not match the expression. The wildcard character () matches any value, including an empty value or a null value. Therefore, the expression NOT error=means that the events must not have an error field at all, regardless of its value.
The search query does not use quotation marks around the source value, which means that it is case-sensitive and exact. If there are any variations in the source name, such as capitalization or spacing, they will not match the query.
Reference
Basic searches and search results
Bernardo
4 months agoMarti
4 months agoRessie
4 months agoIsidra
4 months agoUna
5 months agoJade
5 months agoFiliberto
5 months agoRashida
5 months agoErnestine
5 months agoCassie
6 months agoDominic
6 months agoMalcom
6 months agoSilva
6 months agoBeula
11 months agoCorinne
9 months agoVerda
9 months agoFernanda
9 months agoCarmen
9 months agoMaia
11 months agoShayne
10 months agoMollie
10 months agoJanna
10 months agoNohemi
12 months agoChauncey
10 months agoEloisa
10 months agoShasta
10 months agoMarkus
11 months agoAndree
12 months agoMendy
11 months agoKris
11 months agoBrett
12 months agoJohnetta
12 months agoLeonida
1 year agoEvelynn
1 year ago