SPLK-1004 Transforming Commands And Formatting — 10 Questions

Question 1

You want to create a timechart showing the average response time by host, but you only want to see data for the last 7 days. How do you handle missing time buckets?

Accepted Answer

timechart span=1d avg(resp_time) by host. The 'span' argument in timechart creates buckets, and 'cont=f' prevents missing intervals from being filled with zeroes if preferred, or default behavior is used.

Answer

timechart fill=null avg(resp_time) by host

Answer

timechart avg(resp_time) by host | fillnull

Answer

timechart bucket=1d avg(resp_time) by host

Question 2

You need to format a field containing bytes into a human-readable format like MB or GB. Which command is used?

Accepted Answer

fieldformat size = filesize(size). The 'fieldformat' command allows you to change the display of a field without changing the underlying value.

Answer

rename size as MB

Answer

eval size = tostring(size, 'bytes')

Answer

fieldformat size = tostring(size, 'commas')

Question 3

How do you calculate the percentage of total events for each status code?

Accepted Answer

stats count by status | eventstats sum(count) as total | eval percent = (count/total)*100. The 'addcoltotals' or 'eventcount' can be used, but 'stats' with 'perc' or manual calculation is standard.

Answer

stats count(status) as total

Answer

stats count by status | eval percent = count/total

Answer

chart count by status | addtotals

Question 4

Which command would you use to rename a field to a more readable name in the middle of a search pipeline?

Accepted Answer

rename old_name as new_name. The 'rename' command is the standard way to alias field names.

Answer

fieldformat old_name = new_name

Answer

alias old_name = new_name

Answer

eval new_name = old_name

Question 5

When using 'chart', what is the behavior if you do not specify a 'by' clause?

Accepted Answer

It creates a single-series chart for the entire result set.. If no 'by' clause is provided, 'chart' returns a single series based on the aggregation function.

Answer

It returns an error.

Answer

It defaults to the first field found.

Answer

It returns the same as 'stats'.

Question 6

Which command is used to remove a field from the search results?

Accepted Answer

fields - field_name. The 'fields -' command removes specified fields.

Answer

eval field_name = null

Answer

drop field_name

Answer

delete field_name

Question 7

You are correlating two searches. What is the primary advantage of using 'join' over 'lookup'?

Accepted Answer

Joins allow for subsearch results to be mapped to the primary search results dynamically.. Joins are performed at search time and allow for dynamic subsearch results, whereas lookups are usually static files.

Answer

Lookups cannot be used with stats.

Answer

Joins are faster than lookups.

Answer

Joins are automatically cached.

Question 8

You need to count the total number of unique users per department using the 'stats' command. Which command syntax is correct?

Accepted Answer

stats dc(user) by department. The 'dc' function (distinct count) is used to count unique values in a field.

Answer

stats list(user) by department

Answer

stats values(user) by department

Answer

stats count(user) by department

Question 9

What is the purpose of 'streamstats' compared to 'stats'?

Accepted Answer

It computes aggregates for each event based on current and previous events.. Streamstats calculates statistics as events flow through the pipeline, rather than waiting for all results.

Answer

It can only be used with time-series data.

Answer

It is faster for large datasets.

Answer

It computes aggregates over the entire search result set.

Question 10

You want to filter out events where the 'action' field is empty. Which command is best?

Accepted Answer

where isnotnull(action) AND action!="". The 'where' command allows for complex logical filtering.

Answer

filter action != null

Answer

search action=*

Answer

eval action = if(isnull(action), "remove", action) | search action!="remove"