Splunk Exam SPLK-1002 Topic 5 Question 98 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 98
Topic #: 5

[All SPLK-1002 Questions]

For the following search, which command would further filter for only IP addresses present more than five times?

Aindex=games I stats count as IP_count by IP B. | where IP_count > 5

Bindex=games | search IP_Count > 5

Cindex=games | where IP > 5

Dindex=games I search IP > 5

Show Suggested Answer

Suggested Answer: A

To filter for only IP addresses that appear more than five times in the search results for index=games, you can use a combination of the stats and where commands. The stats command counts the occurrences of each IP address and assigns the count to IP_count. The where command then filters the results to include only those IP addresses with a count greater than five.

Here is how the complete search would look:

index=games | stats count as IP_count by IP | where IP_count > 5

Splunk Docs: stats command

Splunk Docs: where command

Splunk Answers: Filtering results using stats and where commands

by Madonna at Sep 15, 2024, 08:27 PM

Limited Time Offer

25%

1 months ago

I'm leaning towards B. The 'IP_Count > 5' part seems straightforward and gets the job done.

upvoted 0 times

Tommy

15 days ago

User2: Agreed, the 'IP_Count > 5' filter is what we need.

upvoted 0 times

...

Raymon

19 days ago

User1: I think B is the correct answer too.

upvoted 0 times

...

Reena

1 months ago

Option A looks good to me. The 'stats count as IP_count by IP' part should give us the count for each IP address, and then we can filter for the ones with more than 5 occurrences.

upvoted 0 times

Leah

15 days ago

User 2: Yeah, the 'stats count as IP_count by IP' part will help us filter for IP addresses with more than 5 occurrences.

upvoted 0 times

...

Geraldo

20 days ago

User 1: I think option A is the correct one.

upvoted 0 times

...