Which are valid ways to create an event type? (Choose all that apply.)
Which are valid ways to create an event type? (Choose all that apply.)
Valid ways to create an event type include going to the Settings menu and clicking Event Types > New, and selecting an event in search results and clicking Event Actions > Build Event Type. These methods allow you to define and save event types directly through the Splunk interface. The props.conf file is not used for event types creation, and there is no searchtypes command to create event types.
C & D are correct
Not sure about C - not sure if "Settings menu" is the same as "Save As" (p.202) D is correct - (p.203)
A. using findtypes could have been a way - X B. Eventypes.conf separate file not props.conf - X C. Possible D. Possible Another way is save as menu .. Answer seems CD
answer is ACD
C and D are the right answer
C, but also D is valid (check the UI)
C and D are correct
C and D are both ways to create a new event type
C&D I think: There are two ways to create an event type after we have decided the search criteria. One is to run a search and then save it as an Event Type. Another is to add a new Event Type from the settings tab. We will see both the ways of creating it in this section.
C and d are the correct answers. You can go into into an event, on the drop down event actions button select - 'Build Event Type'
C & D are correct
It's both C & D.
There are 4 ways to create an event type: 1-Using Search 2-Using Build Event Type Utility 3-Using Splunk Web 4-Configuration files (eventtypes.conf)