The search query sourcetype=access_combined would return events from the access_combined sourcetype, which is a predefined sourcetype in Splunk that matches the access-common or access-combined Apache logging formats1. The sourcetype field is case-sensitive, so using different capitalization such as Access_Combined or ACCESS_COMBINED would not match the exact sourcetype name2. The sourcetype field is also a default field that is added by the indexer when it indexes the data, so it does not need to be enclosed in quotation marks3.
References
List of pretrained source types
Search command syntax details
Basic searches and search results
Question 2
When a Splunk search generates calculated data that appears in the Statistics tab. in what formats can the results be exported?
Options:
A.
CSV, JSON, PDF
B.
CSV, XML JSON
C.
Raw Events, XML, JSON
D.
Raw Events, CSV, XML, JSON
Answer:
D
Question 3
What is one benefit of creating dashboard panels from reports?
Options:
A.
Any newly created dashboard will include that report.
B.
There are no benefits to creating dashboard panels from reports.
C.
It makes the dashboard more efficient because it only has to run one search string.
D.
Any change to the underlying report will affect every dashboard that utilizes that report.