SPLK-1004: Splunk Core Certified Advanced Power UserDemo

By Splunk · Question Mode

QuestionQ82

Correlating Events

Which statement is true about using a KV Store Collection as a lookup?

  • A Each collection must have at least 3 fields, one of which need to match values of a field in your event data.
  • B Each collection must have at least 2 fields, one of which need to match values of a field in your event data.
  • C Each collection must have at least 2 fields, none of which need to match values of a field in your event data.
  • D Each collection must have at least 3 fields, none of which need to match values of a field in your event data.
Explanation

A KV Store collection used for a lookup should contain at least two fields. One field must have values that match values in an event-data field so Splunk can perform lookup matching; the other field or fields provide the corresponding output data.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!