Splunk Core Certified Power User — Question 203

What is the correct syntax to find events associated with a tag?

Answer options

• A. tag:<field>=<value>
• B. tags=<value>
• C. tags:<field>=<value>
• D. tag=<value>

Correct answer: D

Explanation

The correct syntax for searching events associated with a tag is 'tag=<value>', which directly specifies the tag value. The other options either use incorrect syntax or are not the appropriate method to filter by tag, making them invalid for this purpose.