Based on the _raw_log and XQL query information below, what will be the result(s) of the temp_value?

The correct answer is A. 123. The XQL query uses regextract with conditions to check if the source IP begins with 149.235. When true, it assigns the replacement value 192.168.10.1, otherwise it extracts the source port. From the given logs, this produces 123 (from the port extraction in the second log) and…

Data Ingestion and Management

Question

Exhibit

Options

A123
B20
C10.120.80.2
D149.235.219.208

How the community answered

(28 responses)

A
75% (21)
B
7% (2)
C
14% (4)
D
4% (1)

Explanation

The XQL query uses regextract with conditions to check if the source IP begins with 149.235. When true, it assigns the replacement value 192.168.10.1, otherwise it extracts the source port. From the given logs, this produces 123 (from the port extraction in the second log) and 192.168.10.1 (replacement for the first log's matching source IP).

Topics

#XQL query#log parsing#field extraction#query evaluation

Community Discussion

No community discussion yet for this question.

Full XSIAM-ENGINEER Practice