Free Preparation Discussions
MENU
Splunk SPLK-2003 Exam - Topic 7 Question 67 Discussion
Topic #: 7
A new project requires event data from SOAR to be sent to an external system via REST. All events with the label notable that are in new status should be sent. Which of the following REST Django expressions will select the correct events?
A.
B.
C.
D.
The correct REST Django expression to retrieve events with the label 'notable' that are in the 'new' status is using the container endpoint, as containers are used to store events and associated data in Splunk SOAR. The expression correctly filters the events by label (_filter_label='notable') and status (_filter_status='new'), ensuring only notable events that are still in the 'new' status are selected.
A and D reference the wrong endpoints (event and notable respectively), which do not align with the container-based model used in Splunk SOAR for storing and filtering events.
B is incorrect due to the use of _filter_name instead of _filter_label, which is not a valid filter in this context.
Splunk SOAR Documentation: REST API Endpoints.
Splunk SOAR Developer Guide: Using Django REST for Filtering.
Stanford
7 months agoTy
7 months agoJamal
7 months agoShoshana
7 months agoNiesha
8 months agoAnnalee
8 months agoMose
8 months agoMicah
8 months agoCorazon
9 months agoIsaac
9 months agoGlory
9 months agoReena
9 months agoGarry
9 months agoCarole
11 months agoTyra
10 months agoAlease
11 months agoMarshall
11 months agoKerry
10 months agoHerminia
10 months agoDominic
11 months agoHui
11 months agoPansy
11 months agoCarisa
11 months agoGail
11 months agoRebecka
12 months agoKristofer
12 months agoIsabelle
10 months agoGail
11 months agoDiane
11 months agoStephane
11 months agoTess
12 months agoRebecka
1 year agoBettina
1 year agoLuz
11 months agoKenneth
11 months agoMarci
12 months agoTess
1 year agoRebecka
1 year ago