SPLK-1004 Transforming Commands And Formatting — 20 Questions

Question 1

You want to create a timechart showing the average response time by host, but you only want to see data for the last 7 days. How do you handle missing time buckets?

Accepted Answer

timechart span=1d avg(resp_time) by host. The 'span' argument in timechart creates buckets, and 'cont=f' prevents missing intervals from being filled with zeroes if preferred, or default behavior is used.

Answer

timechart fill=null avg(resp_time) by host

Answer

timechart avg(resp_time) by host | fillnull

Answer

timechart bucket=1d avg(resp_time) by host

Question 2

You need to format a field containing bytes into a human-readable format like MB or GB. Which command is used?

Accepted Answer

fieldformat size = filesize(size). The 'fieldformat' command allows you to change the display of a field without changing the underlying value.

Answer

rename size as MB

Answer

eval size = tostring(size, 'bytes')

Answer

fieldformat size = tostring(size, 'commas')

Question 3

How do you calculate the percentage of total events for each status code?

Accepted Answer

stats count by status | eventstats sum(count) as total | eval percent = (count/total)*100. The 'addcoltotals' or 'eventcount' can be used, but 'stats' with 'perc' or manual calculation is standard.

Answer

stats count(status) as total

Answer

stats count by status | eval percent = count/total

Answer

chart count by status | addtotals

Question 4

Which command would you use to rename a field to a more readable name in the middle of a search pipeline?

Accepted Answer

rename old_name as new_name. The 'rename' command is the standard way to alias field names.

Answer

fieldformat old_name = new_name

Answer

alias old_name = new_name

Answer

eval new_name = old_name

Question 5

When using 'chart', what is the behavior if you do not specify a 'by' clause?

Accepted Answer

It creates a single-series chart for the entire result set.. If no 'by' clause is provided, 'chart' returns a single series based on the aggregation function.

Answer

It returns an error.

Answer

It defaults to the first field found.

Answer

It returns the same as 'stats'.

Question 6

Which command is used to remove a field from the search results?

Accepted Answer

fields - field_name. The 'fields -' command removes specified fields.

Answer

eval field_name = null

Answer

drop field_name

Answer

delete field_name

Question 7

You are correlating two searches. What is the primary advantage of using 'join' over 'lookup'?

Accepted Answer

Joins allow for subsearch results to be mapped to the primary search results dynamically.. Joins are performed at search time and allow for dynamic subsearch results, whereas lookups are usually static files.

Answer

Lookups cannot be used with stats.

Answer

Joins are faster than lookups.

Answer

Joins are automatically cached.

Question 8

You need to count the total number of unique users per department using the 'stats' command. Which command syntax is correct?

Accepted Answer

stats dc(user) by department. The 'dc' function (distinct count) is used to count unique values in a field.

Answer

stats list(user) by department

Answer

stats values(user) by department

Answer

stats count(user) by department

Question 9

What is the purpose of 'streamstats' compared to 'stats'?

Accepted Answer

It computes aggregates for each event based on current and previous events.. Streamstats calculates statistics as events flow through the pipeline, rather than waiting for all results.

Answer

It can only be used with time-series data.

Answer

It is faster for large datasets.

Answer

It computes aggregates over the entire search result set.

Question 10

You want to filter out events where the 'action' field is empty. Which command is best?

Accepted Answer

where isnotnull(action) AND action!="". The 'where' command allows for complex logical filtering.

Answer

filter action != null

Answer

search action=*

Answer

eval action = if(isnull(action), "remove", action) | search action!="remove"

Question 11

You want to see a list of unique 'clientip' addresses. Which command is most efficient?

Accepted Answer

dedup clientip. The 'dedup' command is designed to show unique occurrences of a field.

Answer

stats count by clientip

Answer

head 100

Answer

chart clientip

Question 12

Which 'eval' function is used to handle conditional logic?

Accepted Answer

case(). The 'case' function is specifically designed for multiple conditional tests.

Answer

if-then-else

Answer

switch()

Answer

choose()

Question 13

What is the limitation of using 'join' in a search?

Accepted Answer

The subsearch result limit is 100 by default.. Joins are memory-intensive and have strict limits on the number of results they can process.

Answer

Joins only work on numerical fields.

Answer

Joins are deprecated in Splunk.

Answer

Joins cannot be used with subsearches.

Question 14

How do you add a total row to a stats table?

Accepted Answer

addtotals. The 'addcoltotals' command adds a row containing the sum of all numerical columns.

Answer

addsum

Answer

eval total = sum(field)

Answer

stats total

Question 15

You want to round a number in a field to two decimal places. Which function is used?

Accepted Answer

eval new_field = round(old_field, 2). The 'round' function takes the field and the number of decimal places.

Answer

format new_field = 2

Answer

eval new_field = floor(old_field, 2)

Answer

eval new_field = ceil(old_field, 2)

Question 16

What is the difference between 'chart' and 'timechart'?

Accepted Answer

Timechart automatically buckets by time.. Timechart forces the x-axis to be time-based, while chart allows any field on the x-axis.

Answer

They are identical commands.

Answer

Chart is for time-based data.

Answer

Timechart is for non-time fields.

Question 17

Which command is used to display specific fields in the output?

Accepted Answer

fields. The 'fields' command is used to include or exclude fields from the results.

Answer

display

Answer

select

Answer

show

Question 18

How do you extract a portion of a string using 'eval'?

Accepted Answer

eval new = substr(old, 1, 5). The 'substr' function extracts a substring based on start and length indices.

Answer

eval new = cut(old, 1, 5)

Answer

eval new = slice(old, 1, 5)

Answer

eval new = extract(old, 1, 5)

Question 19

When using 'stats', how does the 'values()' function differ from 'list()'?

Accepted Answer

Values() returns unique values, list() returns all values.. Values() returns unique entries, while list() returns every entry found.

Answer

List() sorts the data automatically.

Answer

Values() is faster than list().

Answer

Values() is only for numbers.

Question 20

Which command sorts results by a field in descending order?

Accepted Answer

sort -field. The 'sort -field' syntax sorts in reverse (descending) order.

Answer

sort desc(field)

Answer

sort field=desc

Answer

sort field