PdfPrep.com

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?
A . $fieldname$
B . “fieldname”
C . %fieldname%
D . _fieldname_

Answer: C

Explanation:

Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Configure/Createcorrelationsearch

Exit mobile version