Creating a Log Event Alert Action core-certified-advanced-power-user Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An admin has configured a log event alert action and wants to verify that it works correctly before deploying to production. What is the best way to test it?

   • AReview the alert's schedule to ensure it fires frequently.
   • BVerify that the search returns results by running it in the search app.
   • CCheck the alert's permissions to ensure the admin has access.
   • DRun the alert manually and then search the target index for the log entry.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team wants to use log event alert actions to create an audit trail of all alert triggers. They are concerned about the volume of log entries and the impact on index storage. What is a key consideration?

   • ALog event actions can generate a high volume of entries, increasing storage costs and potentially impacting index performance.
   • BLog event actions automatically compress entries, reducing storage impact.
   • CLog event actions write to the `_internal` index, which has unlimited storage.
   • DLog event actions are limited to one entry per alert, so volume is not a concern.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which consideration is important when using the log event alert action?

   • AThe log source must be a Splunk index with proper permissions
   • BThe alert must run on a schedule, not in real-time
   • CThe destination log file must be writable by the Splunk process
   • DThe message content must be in JSON format
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In Splunk, what is the primary purpose of the log event alert action?

   • ATo write a custom message to a specified log source when an alert condition is met
   • BTo execute a Python script on the search head when an alert triggers
   • CTo send an email notification to a distribution list when an alert condition is met
   • DTo create a new Splunk index and store the alert results in it
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Splunk admin creates a log event alert action that writes a message containing a large multi-line JSON payload from a search result. The admin notices the log entry is truncated. What is the most likely cause?

   • AThe `_internal` index has a retention policy that deletes large events.
   • BThe log event action has a maximum message size limit, and the JSON payload exceeds it.
   • CThe alert action is configured with `severity = debug`, which limits the message length.
   • DThe search results are not sorted, causing the JSON to be cut off.
   Reveal Solution Discussion Select an answer first