During an ad-hoc hunt, the analyst has civic failed-logon counts per user and wants low, med, and high buckets. Which eval form classifies those results?
Select an answer to reveal the explanation.
Short Explanation
Think of a parking-ticket sorter: a few failures in the low bin, a pile in the high bin. eval with case or if is that sorter for the hunt table. A formal risk notable is not required to label a scratch investigation.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, conditional eval using case or if classifies numeric or string results into analyst-defined buckets during an ad-hoc hunt. With civic failed-logon counts per user already in hand, eval with case or if labels low, med, and high buckets so the hunt table resembles a risk view without creating production RBA content or risk notables. Claiming eval cannot classify and that only a risk notable can create low, med, and high labels fails by concept because ad-hoc classification is a search-time analysis step independent of production notables. Using rex on the count field because classification is a regex problem fails by concept because bucketing numeric counts is conditional logic, not pattern extraction. Using transaction startswith=low endswith=high to invent the buckets fails by concept because startswith/endswith bound sessions by event content; they do not classify aggregate counts into severity bins. Exam caveat: SPLK-5001 expects eval conditionals (case/if) for classifying hunt results into civic severity buckets without requiring a formal risk notable. Operational check: pipe failed-logon counts by user into eval case/if for low/med/high, spot-check boundary users against raw failure volume, use the buckets to prioritize help-desk and privileged civic accounts for follow-up, and promote durable RBA content only if the pattern should become continuous monitoring.