Splunk Core Certified Power User — Question 188

Which of the following searches will return events containing a tag named Privileged?

Answer options

• A. tag=Priv
• B. tag=Priv*
• C. tag=priv*
• D. tag=privileged

Correct answer: B

Explanation

The correct answer is B, as the asterisk (*) allows for wildcard matching, enabling the search to find any tag that starts with 'Priv', including 'Privileged'. Option A will not match 'Privileged' fully, C is case-sensitive and won't match properly, and D does not utilize a wildcard, which limits the search to that exact string only.