Splunk Enterprise Certified Architect — Question 40

Which of the following is a problem that could be investigated using the Search Job Inspector?

Answer options

• A. Events are not being sorted in reverse chronological order.
• B. Different users are seeing different extracted fields from the same search.
• C. Error messages are appearing underneath the search bar in Splunk Web.
• D. Dashboard panels are showing "Waiting for queued job to start" on page load.

Correct answer: B

Explanation

The correct answer is B because the Search Job Inspector helps identify discrepancies in results that different users might encounter from the same search, which relates directly to extracted fields. Options A, C, and D refer to issues that do not specifically involve the variation in extracted fields for different users, making them less relevant for this tool's investigation.