Logging and Indexing Searchable Alert Events core-certified-advanced-power-user Practice Questions (Page 3)

Questions 11–14

1. 11foundation · easy

   Which search command is most appropriate for retrieving logged alert events from the index?

   • Atstats count from datamodel=Alerts
   • Bdbinspect index=_internal
   • Cinputlookup alerts.csv
   • Dsearch index=_internal sourcetype=stash
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When configuring alert logging, which index is used by default for storing logged alert events?

   • A_internal
   • Balerts
   • Cmain
   • D_audit
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An admin is troubleshooting why alert events are not appearing in the `_internal` index. The admin has verified that 'Log alert events' is enabled for the alert. What should the admin check next?

   • ACheck if the `_internal` index is being replicated to the search head.
   • BConfirm that the alert is using the 'Email' action, as other actions are not logged.
   • CVerify that the alert action is actually firing by checking the alert's history in Splunk Web.
   • DEnsure that the alert is scheduled to run at least once per hour.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Splunk admin needs to ensure that alert events are stored in a dedicated index for compliance, separate from the `_internal` index. What is the correct way to configure this?

   • AEdit `indexes.conf` to redirect all `_internal` events to a new index.
   • BIn the alert configuration, set the 'Index' field to the custom index name.
   • CUse a search macro in the alert to route events to the custom index.
   • DCreate a new sourcetype for the alert and assign it to the custom index.
   Reveal Solution Discussion Select an answer first