MENU
An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?
Suggested Answer: C
Get Premium SPLK-5001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
28 comments · newest first
GW
Gwen
10 months ago
I’m surprised there’s no mention of using `timechart` here!
AD
Adelaide
11 months ago
C is the best choice, A and D don't make sense.
LU
Luis
11 months ago
Wait, why not option A? Seems like it could work too.
CE
Cecil
11 months ago
Definitely agree with C, it uses stats correctly.
LI
Linn
11 months ago
I think option C is the right one!
LA
Larae
12 months ago
I think option C is the one that makes the most sense, but I could be mixing it up with another question we did in class.
KA
Karan
12 months ago
I feel like `eval` isn't the right command for this; it seems more about creating new fields rather than counting.
ME
Meaghan
12 months ago
I remember practicing with the `transaction` command, but it feels like it might be overkill for just counting failed attempts.
LE
Leota
1 year ago
I think the `stats` command is what we used for counting events by a field, but I'm not completely sure if that's the best choice here.
SA
Sanjuana
1 year ago
I'm leaning towards option C with the stats command. It's a classic Splunk pattern for getting counts by a field, and it should give me the results I need in a nice sorted format.
BL
Blossom
1 year ago
Ah, the eval command looks promising. I can use that to create a new field for the failed attempt count and then sort on that. Seems like a good approach to me.
IS
Isadora
1 year ago
I think the stats command is the way to go here. It's a pretty straightforward way to get the count of failed login attempts by IP address.
JU
Julio
1 year ago
Hmm, I'm a bit unsure about this one. The transaction command could also work, but I'm not sure if that would give me the exact count I need. I'll have to think this through carefully.
MA
Marya
1 year ago
I think option A makes sense because comparing with competitors can help identify gaps in our strategy.
TA
Tarra
2 years ago
Hmm, I'm not sure. D seems a bit strange - 'sum' instead of 'count'? I'm leaning towards C, but I'll double-check the docs just in case.
TA
Tammy
2 years ago
I think D is the correct answer because we need to sum the count of failed attempts by IP address.
TA
Tammara
2 years ago
I'd go with B. The 'transaction' command can group the failed login events by IP and provide the count, which is what we need here.
VA
Valda
2 years ago
Definitely B. The 'transaction' command is perfect for grouping events like failed login attempts by IP.
AN
Anastacia
2 years ago
I agree, B is the way to go. It will help us analyze the number of failed login attempts by IP address.
HO
Hollis
2 years ago
Yeah, B seems like the right choice. It will give us the count of failed attempts by IP.
NI
Nieves
2 years ago
I think B is the best option too. It groups the failed login attempts by IP address.
EI
Eileen
2 years ago
I'm not sure, but I think A could also be a possible answer.
MA
Marylin
2 years ago
Option C looks good to me. The 'stats' command is perfect for aggregating the failed login attempts by IP address.
DE
Delfina
2 years ago
Agreed, it's perfect for aggregating the data.
GR
Gregoria
2 years ago
Yeah, the 'stats' command is great for that.
DA
Dana
2 years ago
I think option C is the way to go.
RO
Robt
2 years ago
I disagree, I believe the answer is B.
AN
Antione
2 years ago
I think the answer is C.