An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address…

Question

Options

• Aindex=security_logs eventtype=failed_login | eval count as failed_attempts by src_ip | sort -
• Bindex=security_logs eventtype=failed_login | transaction count as failed_attempts by src_ip | sort -
• Cindex=security_logs eventtype=failed_login | stats count as failed_attempts by src_ip | sort -
• Dindex=security_logs eventtype=failed_login | sum count as failed_attempts by src_ip | sort -

• A
  6% (1)
• B
  11% (2)
• C
  78% (14)
• D
  6% (1)

Explanation

Option C is correct because stats is the SPL command that aggregates data and produces a tabular result set - essentially a temporary in-memory table - making it ideal for counting events grouped by a field like src_ip. A is wrong because eval creates or transforms field values within existing events but does not aggregate or group results by a field. B is wrong because transaction groups events into transactions based on shared fields or time proximity, not aggregate counts - it's used for session analysis, not simple counting. D is wrong because sum is not a standalone SPL command; it's an aggregation function used inside stats (e.g., stats sum(bytes) by src_ip).

Memory tip: Think "stats = statistics table" - whenever you need to count, sum, average, or group events into a clean table, stats is your go-to command. If you see a question asking for aggregation by a field, reach for stats count by <field>.

No community discussion yet for this question.