nerdexam
CrowdStrike

CCFH-202B · Question #7

You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

The correct answer is C. table. The table command is used to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. It takes one or more field names as arguments and displays them in a tabular format. The fields command is used to keep or remove fields…

Event Search and Query Fundamentals

Question

You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

Options

  • Afields
  • Bdistinct count
  • Ctable
  • Dvalues

How the community answered

(41 responses)
  • A
    5% (2)
  • B
    2% (1)
  • C
    90% (37)
  • D
    2% (1)

Explanation

The table command is used to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. It takes one or more field names as arguments and displays them in a tabular format. The fields command is used to keep or remove fields from search results, not to display them in a list. The distinct_count command is used to count the number of distinct values of a field, not to display them in a list. The values command is used to display a list of unique values of a field within each group, not to display all event occurrences.

Topics

#table command#SPL commands#field selection#Event Search

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice