When threat hunting for outliers in Splunk, which of the following SPL pipelines would filter for users with over a thousand occurrences?

Question

Options

• A| sort by user | where count > 1000
• B| stats count by user | where count > 1000 | sort - count
• C| top user
• D| stats count(user) | sort - count | where count > 1000

• A
  6% (1)
• B
  83% (15)
• D
  11% (2)

Explanation

Option B works because stats count by user first aggregates event counts per user, creating a result set where each row represents one user with their total count - only then can where count > 1000 meaningfully filter outliers, with sort - count ordering results highest-to-lowest.

Why the distractors fail:

• A - sort by user uses invalid syntax and, more critically, never creates a count field, so the where count > 1000 clause has nothing to filter against.
• C - top user shows the most frequent users by default (top 10) but applies no threshold filter; it can't isolate users specifically over 1000 occurrences.
• D - stats count(user) without a by clause returns a single total count across all events, not a per-user breakdown, so the subsequent filter can never compare individual users.

Memory tip: Think of the SPL pipeline as "Aggregate → Filter → Sort" (AFS). You must create the count with stats ... by user before you can filter it with where - just like you can't sift flour before you mill the wheat.

No community discussion yet for this question.