What is the correct Simple XML syntax for a base search and post-process search?
Short answer
A <search id="myBaseSearch">, <search base="myBaseSearch">
Question
Key Takeaways
The exam tests your ability to distinguish the 'id' attribute (used to name the base search) from the 'base' attribute (used to reference that base search in a post-process search). The trap is confusing id, base, and other XML element names like panel or globalsearch.
In Splunk Simple XML, a base search is defined with <search id="name"> and its post-process search references it using <search base="name">. Community consensus confirms option A is the accepted syntax for linking post-process searches to saved base searches.
Common mistake: Choosing options with 'globalsearch' or 'panel' as attributes, because those are not valid Splunk Simple XML attributes for defining or referencing base searches. Only <search id="..."> and <search base="..."> correctly pair a base search with its post-process search.
Expert Analysis
Why the Answer Is Correct
Option A correctly uses <search id="myBaseSearch"> to define the base search and <search base="myBaseSearch"> to reference it in the post-process search. This follows Splunk's official documentation, which specifies that post-process searches use the base attribute to point to the id of an existing base search. The community comments confirm this: one commenter notes the example under "Basic post-process search" in Splunk docs, and another explicitly states that if your search id is "myBaseSearch", the base search should reference "myBaseSearch".
Why the Other Options Are Wrong
Option B uses globalsearch, which is not a valid XML attribute in this context; Splunk uses id and base, not globalsearch. Option C incorrectly places the id on a <panel> element, but panels are for layout and do not define search IDs; the <search> element must carry the id. Option D uses a different id (myGlobalSearch) for the base search but then references myBaseSearch in the post-process search, which would fail because the id does not match. Only option A maintains the correct pairing of id and base attributes.
Community Comment Notes
The comments are unanimous in supporting option A. One commenter cites the official Splunk documentation link for post-process searches, which is a valuable reference for exam preparation. Another comment reinforces the matching rule: the base attribute value must equal the id of the base search. No comments express doubt or offer alternative interpretations, making option A the clear consensus answer.
Official Reference
https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_searches_2
This link opens the official vendor documentation in a new tab.
Exam Strategy
When you see Simple XML questions, remember the key pairing: <search id="name"> defines the base search, and <search base="name"> creates the post-process search. Always verify that the value in base exactly matches the value in id; the exam often tests this matching rule with slightly different names in the options.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Eddie_exam 👍 2 Answered ACorrect answer is A. See example under Basic post-process search on https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_searches_2
-
marinatedcohort 👍 1 Answered Aif your search id is "myBaseSearch", then your base search should reference "myBaseSearch". Answer A is correct
-
emlch 👍 1For base search <search id="name"> Post-process <search base="myBaseSearch">
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SPLK-1004 Questions
Access 130 questions with complete answers and detailed explanations.
View Full SPLK-1004 Practice Test →