A report named "Linux logins" populates a summary index with the search string sourcetype=linux_secure| sitop src_ip user. Which of the following correctly searches against the summary index for…

The correct answer is B. index=summary search_name="Linux logins" | top src_ip user. When searching against summary data in Splunk, it's common to reference the name of the saved search or report that populated the summary index. The correct search syntax to retrieve data from the summary index populated by a report named "Linux logins" is index=summary…

Statistical Analysis and Reporting

Question

A report named "Linux logins" populates a summary index with the search string sourcetype=linux_secure| sitop src_ip user. Which of the following correctly searches against the summary index for this data?

Options

Aindex=summary sourcetype="linux_secure" | top src_ip user
Bindex=summary search_name="Linux logins" | top src_ip user
Cindex=summary search_name="Linux logins" | stats count by src_ip user
Dindex=summary sourcetype="linux_secure" | stats count by src_ip user

How the community answered

(28 responses)

A
18% (5)
B
71% (20)
C
7% (2)
D
4% (1)

Explanation

When searching against summary data in Splunk, it's common to reference the name of the saved search or report that populated the summary index. The correct search syntax to retrieve data from the summary index populated by a report named "Linux logins" is index=summary search_name="Linux logins" | top src_ip user (Option B). This syntax uses the search_name field, which holds the name of the saved search or report that generated the summary data, allowing for precise retrieval of the intended summary data.

Topics

#summary index#search_name#sitop#report population

Community Discussion

No community discussion yet for this question.

Full SPLK-1004 Practice