Splunk Exam SPLK-2003 Topic 7 Question 67 Discussion

The correct REST Django expression to retrieve events with the label 'notable' that are in the 'new' status is using the container endpoint, as containers are used to store events and associated data in Splunk SOAR. The expression correctly filters the events by label (_filter_label='notable') and status (_filter_status='new'), ensuring only notable events that are still in the 'new' status are selected.

A and D reference the wrong endpoints (event and notable respectively), which do not align with the container-based model used in Splunk SOAR for storing and filtering events.

B is incorrect due to the use of _filter_name instead of _filter_label, which is not a valid filter in this context.

Splunk SOAR Documentation: REST API Endpoints.

Splunk SOAR Developer Guide: Using Django REST for Filtering.