QUESTION: 113

Which search string returns a filed containing the number of matching events and names that field Event Count?

index=security failure | stats sum as "Event Count"
index=security failure | stats count as "Event Count"
index=security failure | stats count by "Event Count"
index=security failure | stats dc(count) as "Event Count"

Answer(s): B

Reveal Solution Next Question

QUESTION: 114

Which search would return events from the access_combined sourcetype?

Sourcetype=access_combined
Sourcetype=Access_Combined
sourcetype=Access_Combined
SOURCETYPE=access_combined

Answer(s): A

Explanation:

The search query sourcetype=access_combined would return events from the access_combined sourcetype, which is a predefined sourcetype in Splunk that matches the access-common or access- combined Apache logging formats1. The sourcetype field is case-sensitive, so using different capitalization such as Access_Combined or ACCESS_COMBINED would not match the exact sourcetype name2. The sourcetype field is also a default field that is added by the indexer when it indexes the data, so it does not need to be enclosed in quotation marks3.
Reference
List of pretrained source types
Search command syntax details
Basic searches and search results

Reveal Solution Next Question