SPLK-1004: Splunk Core Certified Advanced Power User

By Splunk · Question Mode

QuestionQ11

VerifiedFiltering and Formatting Results

A report called "Linux logins" fills a summary index using the search string sourcetype=linux secure | sitop src ip user. Which of the following correctly searches the summary index for this data?

Explanation

Splunk’s sitop command is the summary-indexing counterpart of top. To report on data it generated, search the summary index, constrain the results with the saved-search search_name, and use top with the same fields: src, ip, and user.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!