Posted by: Pdfprep
Post Date: November 21, 2020
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?
A . Save the settings.
B . Apply the correct tags.
C . Run the correct search.
D . Visit the CIM dashboard.
Answer: C
Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata
Leave a Reply