Exam SPLK-1001 topic 1 question 5 discussion

D is correct When you share a report with other users, you have the option of having it run with the permissions of the report "owner" (the person who created the report) or the report "user" (the person who is running the report) Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner

In Splunk, a scheduled report runs with the permissions and access level of its owner. This means the scope of data included in the report is determined by the data the owner has access to, including any restrictions on indexes, source types, or specific field-level access.

Only option B is correct. 'Reports' can be created to run as both Owner or User. But when you set a schedule to a report, making it 'scheduled report' it will run only as the 'owner' of the report.

D is correct. As documentation says the owner can configure it either way

"B" because of this the last sentence... Determine whether to run reports as the report owner or report user When you share a report with other users, you have the option of having it run with the permissions of the report "owner" (the person who created the report) or the report "user" (the person who is running the report). This setting is used for two reasons: It can allow access to search data that might otherwise be unavailable to the person running the report. It helps prevent situations where your concurrent search limit is reached when too many people run reports that you own. All reports run as Owner by default. Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner.

owner is the default view, but but the permissions can be changed.

D is correct, slide 211 of Splunk Material

Option D is not the better answer because it talks about permission configuration which is not related to determining the scope of data that appears in a scheduled report. The scope of data that appears in a scheduled report is determined by the filters and criteria set by the report owner at the time of scheduling the report. The report owner can set the filter criteria based on their requirement, and the report will display the data that matches the criteria. Thus, option B is a better answer because it explains that the data accessible to the owner of the report will appear in the scheduled report.

B. All data accessible to the owner of the report will appear in the report.

IT IS BOTH C + D.

Creator sets the permissions

D, Agree

"Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner."

D is correct. Yes, owner is the default, but the permissions set on a report after the report is saved is what determines who can see it.

But here it says "what determines the scope..." so i think its D

I believe answer should be B. Since for Scheduled Report, not matter how you configure the RunAs scope, it will default back to "Owner" base on the documentation. " Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner. "

D. Im agree