The elections office wants failed logons on high-priority voter-file hosts investigated first. Which SPL sequence best prioritizes that hunt?
Select an answer to reveal the explanation.
Short Explanation
Count the failures on the fast road (tstats), stamp on who owns the box (lookup), then raise a flag for high-priority elections gear (eval). That is how voter-file hosts jump to the front of the queue instead of drowning in a week of raw city logs.
Full Explanation
Named SPL commands combine: tstats aggregates failed logons from an accelerated Authentication model, lookup adds Asset and Identity context such as priority and business unit, and eval flags the high-priority elections assets to investigate first. makeresults does not recover real failures. A week-long transaction across all indexes is inefficient, and foreach on _raw is not how civic asset ranking works.