Splunk Exam SPLK-1002 Topic 10 Question 84 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 84
Topic #: 10

A user wants to create a workflow action that will retrieve a specific field value from an event and run a search in a new browser window

in the user's Splunk instance. What kind of workflow action should they create?

AA Run workflow action, because the user is running a new search with a specific field value from an event returned in the user's search.

BA Search workflow action, because the user is running a new search with a specific field value from an event returned in the user's search.

CA POST workflow action, because the search is being sent to the user's current Splunk instance.

DA GET workflow action, because a field value needs to be retrieved from the events returned in the user's search.

Show Suggested Answer

Suggested Answer: B

A Search workflow action is the appropriate choice when a user wants to retrieve a specific field value from an event and run a search in a new browser window within their Splunk instance (Option B). This type of workflow action allows users to define a search that utilizes field values from selected events as parameters, enabling more detailed investigation or context-specific analysis based on the original search results.

by Catarina at Apr 10, 2024, 07:05 AM

Limited Time Offer

25%

25 days ago

This is a tricky one. The user wants to retrieve a field value from an event and then run a new search in a separate browser window. I'm not sure if that counts as a 'Run' or 'Search' workflow action. Hmm, tough call.

upvoted 0 times

...