Which search string returns a filed containing the number of matching events and names that field Event Count?
Which search string returns a filed containing the number of matching events and names that field Event Count?
The correct search string requires counting the number of matching events and naming that field 'Event Count'. The appropriate function to count events in Splunk is 'stats count', and to rename the resulting field, we use 'as'. Therefore, the correct search string is 'index=security failure | stats count as Event Count'.
By is how grouping occurs, AS renames the field. The question ask for the search string that names the number of matching events (count) Event Count.
Definitely B
B is the correct answer
C is the correct answer...
B has the only correct syntax that also renames the field to Event Count.
"stats count AS" will rename the field given, "stats count BY" will count the number of instances of the field given. Right answer is C.
It's B
Looks like C to me
B is the correct