This search will find all events for the third_party_outages event type that have "EMEA" or "-24h" in the raw event data.
B.
This search will run the third_party_outages saved search and filter for events containing "EMEA" and "-24h" in the raw event data.
C.
This search will run the third_party_outages macro and pass the arguments EMEA and -24h to the macro definition.
D.
This search will find all events in the third_party_outages index with the tags EMEA and -24h.
The Answer Is:
C
This question includes an explanation.
Explanation:
This search will run the third_party_outages macro and pass the arguments EMEA and -24h to the macro definition. A search macro is a reusable chunk of SPL that can be inserted into other searches. A search macro can take arguments that are used to resolve the search string at execution time. The syntax for using a search macro is macro_name (argument1, argument2, ...).ReferencesSee Use search macros in searches and Search macro examples in the Splunk Documentation.
SPLK-1002 PDF/Engine
Printable Format
Value of Money
100% Pass Assurance
Verified Answers
Researched by Industry Experts
Based on Real Exams Scenarios
100% Real Questions
Get 65% Discount on All Products,
Use Coupon: "ac4s65"