Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Splunk SPLK-5001 Exam - Topic 1 Question 5 Discussion

An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?
C) index=security_logs eventtype=failed_login | stats count as failed_attempts by src_ip | sort -failed_attempts
A) index=security_logs eventtype=failed_login | eval count as failed_attempts by src_ip | sort -failed_attempts
B) index=security_logs eventtype=failed_login | transaction count as failed_attempts by src_ip | sort -failed_attempts
D) index=security_logs eventtype=failed_login | sum count as failed_attempts by src_ip | sort -failed_attempts

Splunk SPLK-5001 Exam - Topic 1 Question 5 Discussion

Actual exam question for Splunk's SPLK-5001 exam
Question #: 5
Topic #: 1
[All SPLK-5001 Questions]

An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?

Show Suggested Answer Hide Answer
Suggested Answer: C

by Ryan at Aug 23, 2024, 11:53 PM

Limited Time Offer

25%

Off

Get Premium SPLK-5001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Gwen
7 months ago
I’m surprised there’s no mention of using `timechart` here!
upvoted 0 times
...
Adelaide
8 months ago
C is the best choice, A and D don't make sense.
upvoted 0 times
...
Luis
8 months ago
Wait, why not option A? Seems like it could work too.
upvoted 0 times
...
Cecil
8 months ago
Definitely agree with C, it uses stats correctly.
upvoted 0 times
...
Linn
8 months ago
I think option C is the right one!
upvoted 0 times
...
Larae
9 months ago
I think option C is the one that makes the most sense, but I could be mixing it up with another question we did in class.
upvoted 0 times
...
Karan
9 months ago
I feel like `eval` isn't the right command for this; it seems more about creating new fields rather than counting.
upvoted 0 times
...
Meaghan
9 months ago
I remember practicing with the `transaction` command, but it feels like it might be overkill for just counting failed attempts.
upvoted 0 times
...
Leota
9 months ago
I think the `stats` command is what we used for counting events by a field, but I'm not completely sure if that's the best choice here.
upvoted 0 times
...
Sanjuana
9 months ago
I'm leaning towards option C with the stats command. It's a classic Splunk pattern for getting counts by a field, and it should give me the results I need in a nice sorted format.
upvoted 0 times
...
Blossom
9 months ago
Ah, the eval command looks promising. I can use that to create a new field for the failed attempt count and then sort on that. Seems like a good approach to me.
upvoted 0 times
...
Isadora
9 months ago
I think the stats command is the way to go here. It's a pretty straightforward way to get the count of failed login attempts by IP address.
upvoted 0 times
...
Julio
9 months ago
Hmm, I'm a bit unsure about this one. The transaction command could also work, but I'm not sure if that would give me the exact count I need. I'll have to think this through carefully.
upvoted 0 times
...
Marya
9 months ago
I think option A makes sense because comparing with competitors can help identify gaps in our strategy.
upvoted 0 times
...
Tarra
2 years ago
Hmm, I'm not sure. D seems a bit strange - 'sum' instead of 'count'? I'm leaning towards C, but I'll double-check the docs just in case.
upvoted 0 times
...
Tammy
2 years ago
I think D is the correct answer because we need to sum the count of failed attempts by IP address.
upvoted 0 times
...
Tammara
2 years ago
I'd go with B. The 'transaction' command can group the failed login events by IP and provide the count, which is what we need here.
upvoted 0 times
Valda
2 years ago
Definitely B. The 'transaction' command is perfect for grouping events like failed login attempts by IP.
upvoted 0 times
...
Anastacia
2 years ago
I agree, B is the way to go. It will help us analyze the number of failed login attempts by IP address.
upvoted 0 times
...
Hollis
2 years ago
Yeah, B seems like the right choice. It will give us the count of failed attempts by IP.
upvoted 0 times
...
Nieves
2 years ago
I think B is the best option too. It groups the failed login attempts by IP address.
upvoted 0 times
...
...
Eileen
2 years ago
I'm not sure, but I think A could also be a possible answer.
upvoted 0 times
...
Marylin
2 years ago
Option C looks good to me. The 'stats' command is perfect for aggregating the failed login attempts by IP address.
upvoted 0 times
Delfina
2 years ago
Agreed, it's perfect for aggregating the data.
upvoted 0 times
...
Gregoria
2 years ago
Yeah, the 'stats' command is great for that.
upvoted 0 times
...
Dana
2 years ago
I think option C is the way to go.
upvoted 0 times
...
...
Robt
2 years ago
I disagree, I believe the answer is B.
upvoted 0 times
...
Antione
2 years ago
I think the answer is C.
upvoted 0 times
...

Save Cancel