Splunk Core Certified User Practice Exam

Which command would complete the search to display network failures from the previous week while retrieving specific fields?

1. | fields user, app, src_ip

2. | dedup user, app, src_ip

3. | sort user, app, src_ip

4. | table user, app, src_ip

The correct answer is: | fields user, app, src_ip

The command to use in this scenario is one that allows for the retrieval of specific fields from the search results, which is essential when you're aiming to focus on relevant data without extraneous information. The use of the fields command will limit the output to only include the specified fields, providing a cleaner and more manageable dataset for further analysis. By using the fields command followed by the field names (user, app, src_ip), you effectively instruct Splunk to include only those specific fields in the displayed results. This is particularly beneficial when addressing network failures, as it helps to streamline the output and highlights the relevant information needed for further investigation or reporting. To contrast, dedup would be more appropriate for filtering out duplicate events based on the specified fields, whereas sort organizes the results based on the specified fields but does not limit the output to those fields only. The table command formats the output into a table view, which is useful for presentation but doesn't necessarily restrict the fields returned. Therefore, for the requirement to display network failures while specifically retrieving certain fields, the fields command is the most suitable choice.