Splunk Exam SPLK-1001 Topic 5 Question 65 Discussion

Actual exam question for Splunk's SPLK-1001 exam

Question #: 65
Topic #: 5

Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip

A10

B50

C100

D20

Show Suggested Answer

Suggested Answer: A

The SPL search specified above will return 10 rows of results by default, as the 'top' command specifies a limit of 10 results. The query will search for all events in the security index with a sourcetype of linuxsecure that contain either the terms fail* or invalid and will display the top 10 results according to the src_ip field.

by Bette at Feb 04, 2023, 09:33 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!