Which of the following is the appropriately formatted SPL search?

The correct answer is A. index=security sourcetype=linux secure (invalid OR failed) | stats count as "Potential Issues". This is the appropriately formatted SPL search because it follows the SPL syntax rules12, such Using the = operator to specify field-value pairs, such as index=security and sourcetype=linux. Using the OR operator to combine multiple values for the same field, such as (invalid…

Search Language Fundamentals

Question

Options

Aindex=security sourcetype=linux secure (invalid OR failed) | stats count as "Potential Issues"
Bindex=security sourcetype=linux secure (invalid OR failed) | stats as "Potential Issues"
Cindex--security sourcetype=linux secure (invalid OR failed) | count stats as "Potential Issues"
Dindex--security sourcetype=linux secure (invalid OR failed) | count as "Potential Issues"

How the community answered

(55 responses)

A
75% (41)
B
4% (2)
C
7% (4)
D
15% (8)

Explanation

This is the appropriately formatted SPL search because it follows the SPL syntax rules12, such Using the = operator to specify field-value pairs, such as index=security and sourcetype=linux. Using the OR operator to combine multiple values for the same field, such as (invalid OR failed). Using the | character to separate commands, such as stats count as "Potential Issues". Using the as keyword to rename fields, such as count as "Potential Issues".

Topics

#SPL syntax#stats command#search string formatting#pipe operator

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice