SPLK-5001 · Question #118
As an analyst, tracking unique users is a common occurrence. The Security Operations Center (SOC) manager requested a search with results in a table format to track the cumulative downloads by…
The correct answer is D. eventtype="download" | bin _time span=1d as day | stats values(clientip). This search first bins events by day and uses stats to list each day’s distinct IPs (ips) and count them (dc(clientip)). The streamstats dc(ips) as "Cumulative total" then computes a running distinct count of all IPs seen up through each day, giving the cumulative total you need.
Question
As an analyst, tracking unique users is a common occurrence. The Security Operations Center (SOC) manager requested a search with results in a table format to track the cumulative downloads by distinct IP address. Which example calculates the running total of distinct users over time?
Options
- Aeventtype="download" | bin _time span=1d as day | table clientip day
- Beventtype="download" | bin _time span=1d as day | stats values(clientip)
- Ceventtype="download" | bin _time span=1d as day | stats values(clientip)
- Deventtype="download" | bin _time span=1d as day | stats values(clientip)
How the community answered
(27 responses)- A11% (3)
- B4% (1)
- C4% (1)
- D81% (22)
Explanation
This search first bins events by day and uses stats to list each day’s distinct IPs (ips) and count them (dc(clientip)). The streamstats dc(ips) as "Cumulative total" then computes a running distinct count of all IPs seen up through each day, giving the cumulative total you need.
Topics
Community Discussion
No community discussion yet for this question.