Splunk Enterprise Security Certified Admin — Question 91

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.
What data model should be checked for potential errors such as skipped searches?

Answer options

• A. Web
• B. Risk
• C. Performance
• D. Authentication

Correct answer: D

Explanation

The correct answer is D, as the Authentication data model specifically tracks login and access events, which can reveal issues like skipped searches affecting the Remote Access panel. The other models, while relevant to user activity, do not directly address authentication-related data that might be missing.