When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

Posted by: Pdfprep Category: SPLK-3001 Tags: , ,

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?
A . $fieldname$
B . “fieldname”
C . %fieldname%
D . _fieldname_

Answer: C

Explanation:

Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Configure/Createcorrelationsearch

Leave a Reply

Your email address will not be published.