Splunk Core Certified Power User — Question 102

Which of the following is true about data model attributes?

Answer options

• A. They can only be added into a root search dataset.
• B. They cannot be created within the data model.
• C. They can be added to a dataset from search time field extractions.
• D. They cannot be edited if inherited from a parent dataset.

Correct answer: C

Explanation

Option C is correct because data model attributes can indeed be added to a dataset through field extractions at search time. The other options are incorrect: A is false as attributes can be added to other datasets, B is incorrect since attributes can be created within a data model, and D is misleading as inherited attributes can sometimes be modified.