Splunk Core Certified User — Question 66

Which time range picker configuration would return real-time events for the past 30 seconds?

Answer options

• A. Preset - Relative: 30-seconds ago
• B. Relative - Earliest: 30-seconds ago, Latest: Now
• C. Real-time - Earliest: 30-seconds ago, Latest: Now
• D. Advanced - Earliest: 30-seconds ago, Latest: Now

Correct answer: C

Explanation

The correct answer is C because it specifically indicates a real-time setting for events that have occurred in the last 30 seconds. Options A and B do not specify a real-time context, while option D is labeled as 'Advanced' and does not inherently imply a real-time event stream.