Splunk Exam SPLK-1001 Topic 1 Question 99 Discussion

Actual exam question for Splunk's SPLK-1001 exam

Question #: 99
Topic #: 1

[All SPLK-1001 Questions]

Which of the following is the appropriately formatted SPL search?

Aindex=security sourcetype=linux secure (invalid OR failed) | stats count as
'Potential Issues'

Bindex=security sourcetype=linux secure (invalid OR failed) | stats as
'Potential Issues'

Cindex---security sourcetype=linux secure (invalid OR failed) | count stats as
'Potential Issues'

Dindex---security sourcetype=linux secure (invalid OR failed) | count as 'Potential Issues'

Show Suggested Answer

Suggested Answer: A

This is the appropriately formatted SPL search because it follows the SPL syntax rules12, such as:

Using the=operator to specify field-value pairs, such asindex=securityandsourcetype=linux.

Using theORoperator to combine multiple values for the same field, such as(invalid OR failed).

Using the|character to separate commands, such asstats count as 'Potential Issues'.

Using theaskeyword to rename fields, such ascount as 'Potential Issues'.

by Merri at Sep 19, 2024, 02:18 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Justine

7 months ago

I'm not sure, but I think option D) index---security sourcetype=linux secure (invalid OR failed) | count as 'Potential Issues' might also be correct.

upvoted 0 times

...

Kenneth

7 months ago

I agree with Madelyn, option A seems to be the most appropriately formatted SPL search.

upvoted 0 times

...

Madelyn

7 months ago

I think the correct answer is A) index=security sourcetype=linux secure (invalid OR failed) | stats count as 'Potential Issues'.

upvoted 0 times

...

7 months ago

I'm going with B). The 'as' keyword is supposed to come after the stats command, right?

upvoted 0 times

Jordan

6 months ago

D) index---security sourcetype=linux secure (invalid OR failed) | count as \'Potential Issues\'

upvoted 0 times

...

Anissa

6 months ago

Yes, you are correct. The 'as' keyword should come after the stats command.

upvoted 0 times

...

Shawna

7 months ago

B) index=security sourcetype=linux secure (invalid OR failed) | stats as \'Potential Issues\'

upvoted 0 times

...

Leigha

7 months ago

A) index=security sourcetype=linux secure (invalid OR failed) | stats count as \'Potential Issues\'

upvoted 0 times

...

Kimberlie

8 months ago

A) looks like the correct format to me. The pipe symbol, the stats command, and the 'as' keyword are all in the right places.

upvoted 0 times

Irma

7 months ago

I agree, the pipe symbol, stats command, and 'as' keyword are all in the right places.

upvoted 0 times

...

Bernardine

7 months ago

A) looks like the correct format to me.

upvoted 0 times

...