SPLK-1004: Splunk Core Certified Advanced Power UserDemo

By Splunk · Question Mode

QuestionQ5

Creating and Using Workflow Actions

Which capability must a power user have to create a Log Event alert action?

  • A edit_search_server
  • B edit_udp
  • C edit_tcp
  • D edit_alerts
Explanation

The edit_alerts capability authorizes a user to create and manage alert definitions and their actions. The TCP and UDP capabilities apply to network inputs, and edit_search_server applies to search-server configuration rather than alert creation.

Community Discussion

No comments yet. Be the first to start the discussion!