You need to identify the top 5 source IPs that have triggered the most 'failed_login' events in the last 24 hours. Which command sequence should you use?
Trap 1: index=security sourcetype=auth failed_login | stats count as count…
While this works, the top command is more efficient for this specific requirement.
Trap 2: index=security sourcetype=auth failed_login | table src_ip | count
This syntax is invalid.
Trap 3: index=security sourcetype=auth failed_login | cluster src_ip | head…
Cluster is for pattern discovery, not frequency counts.
- A
index=security sourcetype=auth failed_login | top limit=5 src_ip
The top command automatically calculates counts and limits the result set.
- B
index=security sourcetype=auth failed_login | stats count as count by src_ip | sort -count | head 5
Why wrong: While this works, the top command is more efficient for this specific requirement.
- C
index=security sourcetype=auth failed_login | table src_ip | count
Why wrong: This syntax is invalid.
- D
index=security sourcetype=auth failed_login | cluster src_ip | head 5
Why wrong: Cluster is for pattern discovery, not frequency counts.