SPLK-5001 Exam - Question 16

index=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min | stats count by duration, host

| stats range(_time) as duration by src_ip | index=foo host=i-478619733 | bin duration span=5min | stats count by duration, host

index=foo host=i-478619733 | transaction src_ip |stats count by host

index=foo | transaction src_ip |stats count by host | search host=i-478619733