Cyber Monday 2024! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Free Preparation Discussions
MENU
Splunk Exam SPLK-1002 Topic 5 Question 98 Discussion
Actual exam question for
Splunk's
SPLK-1002 exam
Question #: 98
Topic #: 5
[All SPLK-1002 Questions]
Topic #: 5
For the following search, which command would further filter for only IP addresses present more than five times?
Suggested Answer:
A
To filter for only IP addresses that appear more than five times in the search results for index=games, you can use a combination of the stats and where commands. The stats command counts the occurrences of each IP address and assigns the count to IP_count. The where command then filters the results to include only those IP addresses with a count greater than five.
Here is how the complete search would look:
index=games | stats count as IP_count by IP | where IP_count > 5
Splunk Docs: stats command
Splunk Docs: where command
Splunk Answers: Filtering results using stats and where commands
Stefany
2 months agoMaricela
2 months agoRessie
1 months agoOna
1 months agoJordan
1 months agoDoretha
2 months agoCathern
2 months agoDoretha
2 months agoRichelle
3 months agoPeter
2 months agoVivan
2 months agoTommy
2 months agoRaymon
2 months agoReena
3 months agoLeah
2 months agoGeraldo
2 months ago