For the following search, which command would further filter for only IP addresses present more than five times?

The correct answer is A. index=games I stats count as IP_count by IP B. | where IP_count > 5. To filter on an aggregated count, you must first create the count with stats count as IP_count by IP, then apply | where IP_count > 5 to keep only rows where the count exceeds five. The where command works on computed fields, making this the correct two-step approach. Option B…

Filtering and Grouping Results

Question

Options

Aindex=games I stats count as IP_count by IP B. | where IP_count > 5
Bindex=games | search IP_Count > 5
Cindex=games | where IP > 5
Dindex=games I search IP > 5

How the community answered

(42 responses)

A
90% (38)
B
2% (1)
C
2% (1)
D
5% (2)

Explanation

To filter on an aggregated count, you must first create the count with stats count as IP_count by IP, then apply | where IP_count > 5 to keep only rows where the count exceeds five. The where command works on computed fields, making this the correct two-step approach. Option B uses search IP_Count > 5 which does not work on stats-computed field names correctly. Options C and D attempt to filter on the raw IP field value rather than its count, which is logically incorrect.

Topics

#stats command#where command#filtering results#aggregating data

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice