Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Free Preparation Discussions
MENU
Splunk Exam SPLK-1002 Topic 6 Question 103 Discussion
Actual exam question for
Splunk's
SPLK-1002 exam
Question #: 103
Topic #: 6
[All SPLK-1002 Questions]
Topic #: 6
Which of the following is true about the Splunk Common Information Model (CIM)?
Suggested Answer:
A
To filter for only IP addresses that appear more than five times in the search results for index=games, you can use a combination of the stats and where commands. The stats command counts the occurrences of each IP address and assigns the count to IP_count. The where command then filters the results to include only those IP addresses with a count greater than five.
Here is how the complete search would look:
index=games | stats count as IP_count by IP | where IP_count > 5
Splunk Docs: stats command
Splunk Docs: where command
Splunk Answers: Filtering results using stats and where commands
Serita
1 months agoDick
1 months agoChristiane
2 months agoNarcisa
12 days agoGeorgeanna
1 months agoOlen
2 months agoOmer
2 months agoFairy
29 days agoTayna
1 months agoRose
2 months agoAlease
2 months agoJusta
3 months agoRosalind
3 months ago