MENU
Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip
Suggested Answer: A
Get Premium SPLK-1001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The SPL search specified above will return 10 rows of results by default, as the 'top' command specifies a limit of 10 results. The query will search for all events in the security index with a sourcetype of linuxsecure that contain either the terms fail* or invalid and will display the top 10 results according to the src_ip field.
11 comments · newest first
CE
Celestine
11 months ago
Wait, are you sure about that? Sounds off to me!
MA
Marya
11 months ago
I thought it was 20, but I could be wrong.
SI
Silvana
12 months ago
I always get 100 results, isn't that the standard?
AU
Audria
12 months ago
Definitely 50, that's what I've seen.
DU
Dulce
12 months ago
I think it's 10 by default.
IS
Isadora
1 year ago
I thought it was 100 by default, but now I'm second-guessing myself after reviewing the material.
DI
Dick
1 year ago
I feel like it could be 20, but I can't recall if that's specific to this search or just a guess.
SH
Shaquana
1 year ago
I remember practicing a similar question where the default was 50, but that might have been for a different command.
JO
Josphine
1 year ago
I think the default is usually 10 rows, but I'm not entirely sure.
FI
Fidelia
1 year ago
This looks like a tricky one. I'll need to carefully consider the coverage requirements for each CSCI level and whether the open-source tool can meet them.
LA
Larue
1 year ago
I'm a bit confused on the difference between a pattern and a building block. I'll have to review my TOGAF notes to be sure.