Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Free Preparation Discussions
MENU
Splunk Exam SPLK-1002 Topic 6 Question 103 Discussion
Actual exam question for
Splunk's
SPLK-1002 exam
Question #: 103
Topic #: 6
[All SPLK-1002 Questions]
Topic #: 6
Which of the following is true about the Splunk Common Information Model (CIM)?
Suggested Answer:
A
To filter for only IP addresses that appear more than five times in the search results for index=games, you can use a combination of the stats and where commands. The stats command counts the occurrences of each IP address and assigns the count to IP_count. The where command then filters the results to include only those IP addresses with a count greater than five.
Here is how the complete search would look:
index=games | stats count as IP_count by IP | where IP_count > 5
Splunk Docs: stats command
Splunk Docs: where command
Splunk Answers: Filtering results using stats and where commands
Serita
12 days agoDick
13 days agoChristiane
16 days agoGeorgeanna
2 days agoOlen
26 days agoOmer
27 days agoTayna
3 days agoRose
16 days agoAlease
2 months agoJusta
2 months agoRosalind
2 months ago