Splunk SPLK-5001 Exam - Topic 1 Question 5 Discussion

Actual exam question for Splunk's SPLK-5001 exam

Question #: 5
Topic #: 1

An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?

Aindex=security_logs eventtype=failed_login | eval count as failed_attempts by src_ip | sort -failed_attempts

Bindex=security_logs eventtype=failed_login | transaction count as failed_attempts by src_ip | sort -failed_attempts

Cindex=security_logs eventtype=failed_login | stats count as failed_attempts by src_ip | sort -failed_attempts

Dindex=security_logs eventtype=failed_login | sum count as failed_attempts by src_ip | sort -failed_attempts

Show Suggested Answer

Suggested Answer: C

by Ryan at Aug 23, 2024, 11:53 PM

Limited Time Offer

25%

Off

Get Premium SPLK-5001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Gwen

4 months ago

I’m surprised there’s no mention of using `timechart` here!

upvoted 0 times

...

Adelaide

5 months ago

C is the best choice, A and D don't make sense.

upvoted 0 times

...

Luis

5 months ago

Wait, why not option A? Seems like it could work too.

upvoted 0 times

...

Cecil

5 months ago

Definitely agree with C, it uses stats correctly.

upvoted 0 times

...

Linn

5 months ago

I think option C is the right one!

upvoted 0 times

...

Larae

6 months ago

I think option C is the one that makes the most sense, but I could be mixing it up with another question we did in class.

upvoted 0 times

...

Karan

6 months ago

I feel like `eval` isn't the right command for this; it seems more about creating new fields rather than counting.

upvoted 0 times

...

Meaghan

6 months ago

I remember practicing with the `transaction` command, but it feels like it might be overkill for just counting failed attempts.

upvoted 0 times

...

Leota

6 months ago

I think the `stats` command is what we used for counting events by a field, but I'm not completely sure if that's the best choice here.

upvoted 0 times

...

Sanjuana

6 months ago

I'm leaning towards option C with the stats command. It's a classic Splunk pattern for getting counts by a field, and it should give me the results I need in a nice sorted format.

upvoted 0 times

...

Blossom

6 months ago

Ah, the eval command looks promising. I can use that to create a new field for the failed attempt count and then sort on that. Seems like a good approach to me.

upvoted 0 times

...

Isadora

6 months ago

I think the stats command is the way to go here. It's a pretty straightforward way to get the count of failed login attempts by IP address.

upvoted 0 times

...

Julio

6 months ago

Hmm, I'm a bit unsure about this one. The transaction command could also work, but I'm not sure if that would give me the exact count I need. I'll have to think this through carefully.

upvoted 0 times

...