Splunk Enterprise Certified Admin — Question 14

Which of the following are reserved field names in a KV Store? (Select all that apply.)

Answer options

• A. _key
• B. _time
• C. _user
• D. _source

Correct answer: B, C

Explanation

The correct answers, _time and _user, are reserved field names used by the KV Store for specific functionalities. The other options, _key and _source, are not reserved, and can be used freely without restriction.