Splunk Core Certified User — Question 15

What does the following specified time range do?
earliest=-72h@h latest=@d

Answer options

• A. Look back 3 days ago and prior.
• B. Look back 72 hours, up to one day ago.
• C. Look back 72 hours, up to the end of today.
• D. Look back from 3 days ago, up to the beginning of today.

Correct answer: D

Explanation

The correct answer, D, accurately describes the time range by indicating that it looks back from 3 days ago up to the beginning of today. Option A is incorrect because it does not specify the end of the range. Option B is wrong as it mentions 'one day ago' rather than the beginning of today. Option C incorrectly states that the end is at the conclusion of today instead of the start.