Which search would return events from the access_combined sourcetype?
A) Sourcetype=access_combined
B) Sourcetype=Access_Combined
C) sourcetype=Access_Combined
D) SOURCETYPE=access_combined

Question

Quizplus · Accepted Answer

Splunk searches are case-sensitive for field names and values. The correct field name and value are "sourcetype" and "access_combined" respectively.

Which Search Would Return Events from the Access_combined Sourcetype