SPLK-5001 · Question #78
An analyst is looking for known C2 communication in a few billion NetFlow records, using a query similar to the following: index=network sourcetype=netflow src_ip=149.151.100.4 src_port=908…
The correct answer is B. tstats. The tstats command leverages Splunk’s indexed time-series (tsidx) data structures to perform statistical queries far more efficiently than raw-event searches. By rewriting the query to use tstats against the netflow data model (or a custom data model that maps your NetFlow…
Question
An analyst is looking for known C2 communication in a few billion NetFlow records, using a query similar to the following:
index=network sourcetype=netflow src_ip=149.151.100.4 src_port=908 protocol=ip This query works, but due to the sheer size of the index, it is very slow. Which of the following SPL commands might the analyst use when rewriting their SPL to speed up the search?
Options
- Atable
- Btstats
- Caccelerate
- Dlookup
How the community answered
(19 responses)- A5% (1)
- B74% (14)
- C16% (3)
- D5% (1)
Explanation
The tstats command leverages Splunk’s indexed time-series (tsidx) data structures to perform statistical queries far more efficiently than raw-event searches. By rewriting the query to use tstats against the netflow data model (or a custom data model that maps your NetFlow source types), the search engine can pull counts or other stats directly from the tsidx files, dramatically reducing I/O and speeding up the lookup of known C2 communication.
Topics
Community Discussion
No community discussion yet for this question.