Free Splunk SPLK-1002 Actual Exam Questions - Question 3 Discussion

A imo, because event types typically rely on simple search conditions, and A uses a subsearch that filters based on player_id, which can clearly define a specific set of events.

B/D? B has a clear condition with a where clause, which filters events nicely. D uses stats, but event types usually don’t need aggregation, so B might be more straightforward for defining an event type.

Option C makes sense since it combines field presence and a condition.

B imo, event types usually use field filters, and B’s clear with score>9999.

A imo, because using a subsearch to filter player_ids makes the event type more targeted, unlike just filtering on score or player fields alone. This feels more specific than C or B.

C seems right since it’s filtering on fields, which fits defining event types better. C

Zain U.: B imo, but does the question specify what exactly counts as an event type here? Like, are we looking for something defining a category or a filter?