nerdexam
Splunk

SPLK-1002 · Question #133

Consider the following search: Index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the…

The correct answer is B. index=web sourcetype=access_combined JSESSIONID <SD404K289O2F151>. To view all events sharing a specific JSESSIONID value as a group, the search should include the session ID value as a keyword filter alongside the JSESSIONID field reference.

Filtering and Grouping Results

Question

Consider the following search:

Index=web sourcetype=access_combined The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Options

  • Aindex=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID
  • Bindex=web sourcetype=access_combined JSESSIONID <SD404K289O2F151>
  • Cindex=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151
  • Dindex-web sourcetype=access_combined I transaction JSESSIONID I search

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    89% (17)
  • C
    5% (1)

Why each option

To view all events sharing a specific JSESSIONID value as a group, the search should include the session ID value as a keyword filter alongside the JSESSIONID field reference.

Aindex=web sourcetype=access_combined SD404K289O2F151 I table JSESSIONID

The 'table JSESSIONID' command only reformats results into a tabular column display; it does not filter events to show only those matching a specific JSESSIONID value.

Bindex=web sourcetype=access_combined JSESSIONID <SD404K289O2F151>Correct

The search in option B uses 'JSESSIONID <SD404K289O2F151>' as a combined field and value filter, which finds all events containing that specific session ID. This retrieves and groups together every event that shares the same JSESSIONID, satisfying the requirement to view them collectively.

Cindex=web sourcetype=access_combined I highlight JSESSIONID I search SD404K289O2F151

The 'highlight' command visually marks matching terms in displayed events but does not filter the result set to include only events with a specific JSESSIONID value.

Dindex-web sourcetype=access_combined I transaction JSESSIONID I search

Option D contains a syntax error ('index-web' instead of 'index=web') and the transaction command without a proper value filter does not correctly isolate events for the specific session ID.

Concept tested: Splunk search filtering events by a specific field value

Source: https://docs.splunk.com/Documentation/Splunk/latest/Search/Searchwithfieldlookups

Topics

#Filtering Events#Splunk Search Language#Field-Value Search#Basic Search

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SPLK-1002 Practice