Splunk SOAR Certified Automation Developer — Question 18

Within a correlation search, dynamic field values can be specified with what syntax?

Answer options

• A. fieldname
• B. <fieldname /fieldname>
• C. %fieldname%
• D. eval(fieldname)

Correct answer: C

Explanation

The correct answer is C, as dynamic field values are denoted using the percent signs. Options A and D do not use the correct syntax for dynamic fields, and option B is not a valid format for specifying field names in this context.