Creating a Log Event Alert Action core-certified-advanced-power-user Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An admin is configuring a log event alert action for a high-volume alert that fires every minute. The admin wants to include a field that is only present in some search results. What is the best practice?

   • ASet the severity to `debug` to avoid issues with missing fields.
   • BUse a separate alert for results that have the field.
   • CUse a conditional token or ensure the field is always present by using `fillnull` in the search.
   • DInclude the token as-is; Splunk will skip the message if the field is missing.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An admin is configuring a log event alert action and needs to choose a log source. The alert is for a compliance requirement that mandates all security alerts be stored in a dedicated index. What should the admin set as the log source?

   • AThe `_audit` index
   • BThe `_internal` index
   • CA custom index created for security alerts
   • DThe `main` index
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When configuring a log event alert action in Splunk, which fields must you specify?

   • AIndex, sourcetype, and host
   • BEmail recipient, subject, and body
   • CLog source, severity, and message content
   • DWebhook URL, HTTP method, and payload
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An admin has a log event alert action that writes to a custom index. After a recent upgrade, the action no longer writes entries. The admin checks the execution history and sees the action is failing with a permission error. What is the most likely cause?

   • AThe search results are now empty due to changed field names.
   • BThe alert action configuration was reset to defaults.
   • CThe custom index was deleted during the upgrade.
   • DThe upgrade changed the default permissions for the custom index, and the alert's role no longer has write access.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A team wants to use log event alert actions to track all changes to firewall rules. They are concerned about the performance impact of writing many log entries. What is a recommended approach to mitigate this?

   • AUse a webhook action instead to reduce index load.
   • BUse a throttling condition on the alert to limit how often the action fires.
   • CIncrease the severity to `critical` to reduce the number of entries.
   • DWrite to the `_internal` index instead of a custom index.
   Reveal Solution Discussion Select an answer first