Splunk Core Certified User — Question 3

How can search results be kept longer than 7 days?

Answer options

• A. By scheduling a report.
• B. By creating a link to the job.
• C. By changing the job settings.
• D. By changing the time range picker to more than 7 days.

Correct answer: A

Explanation

Scheduling a report allows for the automated retention of search results beyond the default 7-day limit, enabling users to access historical data as needed. The other options, such as creating a link or adjusting job settings, do not extend the retention period for search results, while changing the time range picker only affects the displayed time frame without altering retention duration.