SPLK-1002 Advanced Searching and Statistics Practice Question

Arrange the steps to create a knowledge object of type 'Event Type' in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Run a search that returns the desired events, then click 'Save As' and select 'Event Type', then enter a name and save.

Event types are created by defining a search string that matches events, then saving with a name.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Run a search that returns the desired events, then click 'Save As' and select 'Event Type', then enter a name and save.
Why this is correct
This order is correct because you first need a search to define the events, then you use the Save As option to create the event type, and finally you name it and save.
✗
Run a search that returns the desired events, then enter a name for the event type, then click 'Save As' and select 'Event Type'.
Why it's wrong here
This order is incorrect because you must click 'Save As' and select 'Event Type' before entering a name; the name is entered in the Save As dialog.
✗
Click 'Save As' and select 'Event Type', then run a search that returns the desired events, then enter a name and save.
Why it's wrong here
This order is incorrect because you need a search result to save as an event type; you cannot select 'Save As' without a search first.
✗
Enter a name for the event type, then click 'Save As' and select 'Event Type', then run a search that returns the desired events.
Why it's wrong here
This order is incorrect because you need to define the search before saving, and naming happens during the Save As process, not before.

Go deeper