MENU
A new project requires event data from SOAR to be sent to an external system via REST. All events with the label notable that are in new status should be sent. Which of the following REST Django expressions will select the correct events?
A.
B.
C.
D.
Suggested Answer: C
Get Premium SPLK-2003 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The correct REST Django expression to retrieve events with the label 'notable' that are in the 'new' status is using the container endpoint, as containers are used to store events and associated data in Splunk SOAR. The expression correctly filters the events by label (_filter_label='notable') and status (_filter_status='new'), ensuring only notable events that are still in the 'new' status are selected.
A and D reference the wrong endpoints (event and notable respectively), which do not align with the container-based model used in Splunk SOAR for storing and filtering events.
B is incorrect due to the use of _filter_name instead of _filter_label, which is not a valid filter in this context.
Splunk SOAR Documentation: REST API Endpoints.
Splunk SOAR Developer Guide: Using Django REST for Filtering.
38 comments · newest first
ST
Stanford
10 months ago
Not sure about Option B, seems off to me.
TY
Ty
10 months ago
I think Option C is the right choice here!
JA
Jamal
10 months ago
Wait, why are we using REST for this?
SH
Shoshana
10 months ago
I can't believe all notable events are in new status!
NI
Niesha
11 months ago
Option A looks solid for filtering notable events.
AN
Annalee
11 months ago
I’m leaning towards Option A, but I remember there were nuances in how the filters were applied in the examples we went through.
MO
Mose
11 months ago
I feel like Option C looks familiar, but I can't recall if it specifically checks for the 'notable' label and 'new' status together.
MI
Micah
11 months ago
I remember practicing a similar question where we had to select events based on multiple criteria. I think it might be Option B, but I’m not completely confident.
CO
Corazon
12 months ago
I think we need to filter by the event label and status, but I’m not sure which option does that correctly.
IS
Isaac
12 months ago
I've got a good handle on Django REST APIs, so I think I can tackle this one. Let me walk through each option and see which one best matches the criteria.
GL
Glory
12 months ago
Option C looks promising - it's filtering for events with the 'notable' label and 'new' status. I'll double-check the other options, but this seems like the right approach.
RE
Reena
1 year ago
Hmm, I'm a bit confused by the different query options. I'll need to make sure I understand the requirements around the event status and label before choosing an answer.
GA
Garry
1 year ago
This looks like a Django REST API question. I'll need to carefully review the options and think through the query logic to select the correct events.
CA
Carole
1 year ago
This question is giving me flashbacks to that time I accidentally sent all the events to the wrong system. Let's just say the boss wasn't too happy about that one. Option C for the win!
TY
Tyra
1 year ago
I agree, Option C looks like the right choice for this scenario.
AL
Alease
1 year ago
If this was a real-world scenario, I'd probably just write a custom SQL query and call it a day. But hey, the exam gods want us to play by their rules, so Option C it is!
MA
Marshall
1 year ago
Option B is trying way too hard. Who needs all that extra stuff when you can just keep it simple with Option C? Gotta love those Django ORM filters!
KE
Kerry
1 year ago
Let's go with Option C for the project then.
HE
Herminia
1 year ago
Definitely, keeping it simple is key in these situations.
DO
Dominic
1 year ago
I agree, Option C with Django ORM filters is much simpler.
HU
Hui
1 year ago
Option B is too complicated. Option C is the way to go.
PA
Pansy
1 year ago
I always prefer simplicity in coding. Option C is the clear choice here.
CA
Carisa
1 year ago
Yeah, Option B seems a bit overcomplicated. Option C is much cleaner.
GA
Gail
1 year ago
I agree, Option C is definitely the way to go. Simple and effective.
RE
Rebecka
1 year ago
That makes sense, thanks for explaining. I'll reconsider my choice.
KR
Kristofer
1 year ago
Hmm, I'm not too sure about this one. It's a tricky question, but I think I'm going to go with Option D just to be safe. Can't go wrong with a classic 'AND' statement, right?
IS
Isabelle
1 year ago
Yeah, I agree. The 'AND' statement is usually a safe bet in these situations.
GA
Gail
1 year ago
I think Option D is the right choice too. It seems like the most logical one.
DI
Diane
1 year ago
Yeah, I agree. The 'AND' statement is usually a safe bet in these situations.
ST
Stephane
1 year ago
I think Option D is the correct one too. It seems like the most logical choice.
TE
Tess
1 year ago
Option C includes the filter for events with the label notable in new status, which matches the requirement.
RE
Rebecka
1 year ago
Why do you think Option C is correct?
BE
Bettina
1 year ago
Option C looks like the way to go. It's filtering for events with the 'notable' label and 'new' status, which is exactly what the question is asking for.
LU
Luz
1 year ago
Great, let's go with Option C then. It meets the criteria of the project's event data requirements.
KE
Kenneth
1 year ago
Yes, Option C specifically filters for events with the 'notable' label and 'new' status, matching the requirements.
MA
Marci
1 year ago
I agree, Option C seems to be the correct choice for this scenario.
TE
Tess
1 year ago
I disagree, I believe Option C is the correct one.
RE
Rebecka
1 year ago
I think the correct REST Django expression is Option A.