Splunk Core Certified Power User — Question 44

Which are valid ways to create an event type? (Choose all that apply.)

Answer options

• A. By using the searchtypes command in the search bar.
• B. By editing the event_type stanza in the props.conf file.
• C. By going to the Settings menu and clicking Event Types > New.
• D. By selecting an event in search results and clicking Event Actions > Build Event Type.

Correct answer: C

Explanation

Option C is correct because it directly describes the process of creating a new event type through the Settings menu. Options A and B do not provide valid methods for creating event types, as they involve searching and editing configurations rather than using the interface. Option D describes a related action but does not directly create a new event type.