Discuss Splunk SPLK-1002 Exam Topic 7 Question 36

Which of the following searches would create a graph similar to the one below?

Aindex_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

Bindex_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

Cindex_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

DNone of these searches would generate a similart graph.

Suggested Answer: C

Get Premium SPLK-1002 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Oliva 11 months ago

I doubt D is correct; one of these has to work!

Lavonne 11 months ago

I agree with C, looks like a timechart to me.

Skye 12 months ago

Wait, none of these? That’s surprising!

Casie 12 months ago

Nah, I’m pretty sure it’s B.

Eleonora 12 months ago

I think option C is the right one.

Art 1 year ago

None of these searches seem to fit what I remember about creating that type of graph. Maybe it's option D?

Omer 1 year ago

I feel like the chart command could be a good option, but I need to double-check how it handles time.

Tequila 1 year ago

I remember practicing with the transaction command, but I can't recall if it was used in a similar context before.

Geoffrey 1 year ago

I think the timechart command might be the right choice, but I'm not completely sure if it matches the graph exactly.

Tonette 1 year ago

I've used Cisco UCS PowerTool before, so I think I've got a good handle on this. Let me double-check the command options and see which two are the best fit.

Leonie 1 year ago

Okay, this looks like a straightforward question about Medicare vs. Medicaid eligibility. I'll need to carefully read the details provided and think through the key criteria.

Rima 1 year ago

Okay, let's see. A ping sweep is when an attacker sends ICMP echo requests to multiple IP addresses to see which ones respond. So the filter should be looking for ICMP echo requests, which would be icmp.type==8. I'm pretty sure that's the right answer.

Merilyn 1 year ago

This seems like a straightforward question about referral policies. I'm pretty confident I can figure this out.

Splunk SPLK-1002 Exam - Topic 7 Question 36 Discussion