Câu 37: SPLK-5001: Splunk Certified Cybersecurity Defense Analyst

When threat hunting for outliers in Splunk, which of the following SPL pipelines would filter for users with over a thousand occurrences?

1. A. | sort by user | where count > 1000
2. B. | stats count by user | where count > 1000 | sort - count — đáp án hiện tại
3. C. | top user
4. D. | stats count(user) | sort - count | where count > 1000