SPLK-1001 · Question #176
Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip
The correct answer is A. 10. The SPL search specified above will return 10 rows of results by default, as the "top" command specifies a limit of 10 results. The query will search for all events in the security index with a sourcetype of linuxsecure that contain either the terms fail* or invalid and will…
Question
Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip
Options
- A10
- B50
- C100
- D20
How the community answered
(61 responses)- A72% (44)
- B3% (2)
- C8% (5)
- D16% (10)
Explanation
The SPL search specified above will return 10 rows of results by default, as the "top" command specifies a limit of 10 results. The query will search for all events in the security index with a sourcetype of linuxsecure that contain either the terms fail* or invalid and will display the top 10 results according to the src_ip field.
Topics
Community Discussion
No community discussion yet for this question.