Creating a Log Event Alert Action core-certified-advanced-power-user Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a known limitation of the log event alert action in Splunk?

   • AIt can only send alerts to email addresses within the same domain
   • BIt cannot include dynamic field values from the search results in the message
   • CIt writes to a log file without any size or format constraints
   • DIt has a maximum message length and may truncate long messages
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which scenario best illustrates a typical use case for the log event alert action in Splunk?

   • ASending a page to an on-call engineer when a critical service fails
   • BAutomatically adding a user to a role when they exceed a threshold
   • CUpdating a lookup table with the latest user login times
   • DWriting a timestamped entry to a local log file whenever a firewall rule change is detected
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   An admin is configuring a log event alert action and wants to include the username of the user who triggered the alert. The search returns a field called `user`. Which token should be used in the message?

   • A$search.user$
   • B$result.username$
   • C$result.user$
   • D$user$
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An admin configures a log event alert action to write a message to the `_internal` index when a specific error occurs. After triggering the alert, the admin searches `index=_internal` but does not see the expected log entry. What is the first step to troubleshoot?

   • AConfirm that the search results include the `_raw` field.
   • BVerify that the `_internal` index has enough disk space.
   • CCheck the alert's execution history for any action failures.
   • DRestart the Splunk Enterprise service to reload the alert configuration.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Splunk admin wants to use a log event alert action to write a message that includes a field with a very long value (e.g., a full stack trace). What should the admin consider?

   • AThe field value will be automatically compressed to fit the limit.
   • BThe log event action will fail if the message exceeds the limit.
   • CThe message may be truncated due to the maximum message size limit.
   • DThe field value will be split into multiple log entries.
   Reveal Solution Discussion Select an answer first