What is the correct Simple XML syntax for a base search and post-process search?
What is an example of the simple XML syntax for a base search and its post-process search?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your ability to distinguish the 'id' attribute (used to name the base search) from the 'base' attribute (used to reference that base search in a post-process search). The trap is confusing id, base, and other XML element names like panel or globalsearch.
In Splunk Simple XML, a base search is defined with <search id="name"> and its post-process search references it using <search base="name">. Community consensus confirms option A is the accepted syntax for linking post-process searches to saved base searches.
Choosing options with 'globalsearch' or 'panel' as attributes, because those are not valid Splunk Simple XML attributes for defining or referencing base searches. Only <search id="..."> and <search base="..."> correctly pair a base search with its post-process search.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A correctly uses <search id="myBaseSearch"> to define the base search and <search base="myBaseSearch"> to reference it in the post-process search. This follows Splunk's official documentation, which specifies that post-process searches use the base attribute to point to the id of an existing base search. The community comments confirm this: one commenter notes the example under "Basic post-process search" in Splunk docs, and another explicitly states that if your search id is "myBaseSearch", the base search should reference "myBaseSearch".
Why the Other Options Are Wrong
Option B uses globalsearch, which is not a valid XML attribute in this context; Splunk uses id and base, not globalsearch. Option C incorrectly places the id on a <panel> element, but panels are for layout and do not define search IDs; the <search> element must carry the id. Option D uses a different id (myGlobalSearch) for the base search but then references myBaseSearch in the post-process search, which would fail because the id does not match. Only option A maintains the correct pairing of id and base attributes.
Community Comment Notes
The comments are unanimous in supporting option A. One commenter cites the official Splunk documentation link for post-process searches, which is a valuable reference for exam preparation. Another comment reinforces the matching rule: the base attribute value must equal the id of the base search. No comments express doubt or offer alternative interpretations, making option A the clear consensus answer.
Official Reference
Exam Strategy
When you see Simple XML questions, remember the key pairing: <search id="name"> defines the base search, and <search base="name"> creates the post-process search. Always verify that the value in base exactly matches the value in id; the exam often tests this matching rule with slightly different names in the options.
Related Analysis
Practice All SPLK-1004 Questions
Access 130 questions with complete answers and detailed explanations.
View Full SPLK-1004 Practice Test →