Splunk Enterprise Security Certified Analyst — Question 73
When utilizing a subsearch within a Splunk SPL search query, which of the following statements is accurate?
Answer options
- A. Subsearches have to be initiated with the | subsearch command.
- B. Subsearches can only be utilized with | inputlookup command.
- C. Subsearches have a default result output limit of 10000.
- D. There are no specific limitations when using subsearches.
Correct answer: C
Explanation
The correct answer is C because subsearches in Splunk do indeed have a default result output limit of 10000, which is important to consider when designing queries. Option A is incorrect as subsearches do not require a specific command to initiate, option B is false since subsearches can be used with various commands, and option D is misleading as there are known limitations associated with subsearches.