Splunk Observability Cloud Certified Associate — Question 1

Which of the following macro values will exclude all of the company networks if it is called from the following search? index=firewall sourcetype=pan:traffic NOT "company_networks"

Answer options

Correct answer: B

Explanation

The correct answer, B, uses the NOT operator with the IN clause to exclude both specified company networks. Option A would include the company networks instead of excluding them, while options C and D incorrectly use the AND operator, which does not achieve the desired exclusion for both networks simultaneously.