Exam SPLK-1004 All QuestionsBrowse all questions from this exam
Question 50

Which of the following would exclude all entries contained in the lookup file baditems.csv from search results?

    Correct Answer: A

    To exclude all entries contained in the lookup file baditems.csv from the search results, the correct syntax would be to use the NOT operator followed by the inputlookup command. This syntax effectively filters out any records that match the criteria in baditems.csv, which matches option A.

Discussion
DeragOption: A

A is the correct answer. This will exclude all events that match any of the values in the 'item' field of the baditems.csv lookup file.