SPLK-1004 Transforming Commands And Formatting — 20 Questions

Question 1

Which command would you use to rename a field to a more readable name in the middle of a search pipeline?

Accepted Answer

rename old_name as new_name. The rename command in SPL is used to rename one or more fields. The syntax 'rename old_name as new_name' changes the field name from old_name to new_name, making it more readable in the middle of a search pipeline. This is a formatting command that does not alter the underlying data.

Answer

fieldformat old_name = new_name

Answer

alias old_name = new_name

Answer

eval new_name = old_name

Question 2

You want to create a timechart showing the average response time by host, but you only want to see data for the last 7 days. How do you handle missing time buckets?

Accepted Answer

timechart span=1d avg(resp_time) by host. The 'span' argument in timechart creates buckets, and 'cont=f' prevents missing intervals from being filled with zeroes if preferred, or default behavior is used.

Answer

timechart fill=null avg(resp_time) by host

Answer

timechart avg(resp_time) by host | fillnull

Answer

timechart bucket=1d avg(resp_time) by host

Question 3

You need to format a field containing bytes into a human-readable format like MB or GB. Which command is used?

Accepted Answer

fieldformat size = filesize(size). The 'fieldformat' command allows you to change the display of a field without changing the underlying value.

Answer

rename size as MB

Answer

eval size = tostring(size, 'bytes')

Answer

fieldformat size = tostring(size, 'commas')

Question 4

You want to filter out events where the 'action' field is empty. Which command is best?

Accepted Answer

where isnotnull(action) AND action!="". The `where` command evaluates arbitrary boolean expressions, and `isnotnull(action)` returns true only when the field exists and has a non-null value, while `action!=""` additionally excludes empty strings. Combining both conditions with AND filters out events where `action` is missing, null, or an empty string. This is the most precise way to remove empty values because `isnull()` alone would not catch empty strings, and `!=` alone would not catch null fields.

Answer

filter action != null

Answer

search action=*

Answer

eval action = if(isnull(action), "remove", action) | search action!="remove"

Question 5

Which 'eval' function is used to handle conditional logic?

Accepted Answer

case(). The case() function in eval is specifically designed to evaluate a series of condition-value pairs and return the value associated with the first condition that evaluates to true. It is the standard conditional logic function in SPL, allowing multiple conditions to be checked in order. This makes it the correct answer for handling conditional logic in eval expressions.

Answer

if-then-else

Answer

switch()

Answer

choose()

Question 6

Which THREE features are available when using the 'lookup' command?

Accepted Answer

Performing left joins. The 'lookup' command in Splunk enriches events by adding fields from an external source, and it supports left joins (A) so that all events from the base search are retained even when no matching lookup entry exists, with null values filled in for unmatched rows. It can also output results to a CSV (B) via the outputlookup command, which writes the enriched results back to a lookup file for later reuse. Wildcards for matching (C) are supported in lookup definitions and in the lookup command's match_type settings, allowing partial or pattern-based field matching rather than only exact matches. By contrast, setting cluster master status (D) is an administrative action performed with the CLI (splunk edit cluster-config) or through the clustering configuration, not a lookup feature, and replacing existing indexes (E) is not something the lookup command does — index management is handled through index configuration and the CLI, not by lookup.

Answer

Setting cluster master status

Answer

Replacing existing indexes

Question 7

Which THREE of the following are valid ways to filter data in Splunk?

Accepted Answer

fields -. Option A (fields) is correct because the fields command explicitly includes or excludes fields from search results (e.g., `| fields host, status`), which filters the data returned. Option D (where) is correct because the where command filters search results using eval-based expressions, such as `| where status >= 400`, removing events that don't match the condition. Option E (search) is correct because the search command filters events by matching keywords, fields, and boolean expressions (e.g., `| search status=404`), narrowing the result set. Option B (eval) is not a filtering command; it calculates and assigns new field values and only filters when combined with a separate command like where or search. Option C (rename) does not filter data at all; it merely renames existing fields in the results.

Answer

eval

Answer

rename

Question 8

Which THREE of the following are valid formatting commands?

Accepted Answer

rename. The three valid formatting commands are rename (A), sort (B), and fieldformat (E). rename (A) is a valid formatting command because it changes the display name of a field in search results without altering the underlying data, which is a presentation-layer operation. sort (B) is valid because it orders result rows by specified fields, a formatting/presentation action applied to the result set. fieldformat (E) is valid because it applies display-time formatting to a field's values (for example, numeric or string formatting) without modifying the indexed data. The remaining options do not belong: index (C) refers to data indexing/management rather than result formatting, and bucket (D) is a command that groups numeric or time values into buckets (a transforming command), not a formatting command.

Answer

index

Answer

bucket

Question 9

A Splunk administrator is troubleshooting a dashboard that uses the timechart command to display average CPU usage per host. The search returns results, but the chart shows a single line labeled 'ALL' instead of separate lines for each host. The search is: index=os sourcetype=cpu | timechart avg(cpu_usage) BY host. What is the most likely cause?

Accepted Answer

The field name 'host' is case-sensitive and must match exactly as it appears in the events, but the actual field might be 'Host' or 'HOST'.. Splunk field names are case-sensitive, so a mismatch between the field name used in the search and the actual field name in the events prevents timechart from splitting the data. The single 'ALL' line appears when the BY field cannot be resolved, causing all events to be aggregated into one series. Verifying the exact field name corrects the visualization.

Answer

The host field is not present in the raw events, so timechart cannot split by it.

Answer

The avg(cpu_usage) function is not supported by timechart and must be replaced with mean(cpu_usage).

Answer

The timechart command requires the BY clause to be placed before the statistical function, e.g., timechart BY host avg(cpu_usage).

Question 10

A security analyst needs to identify source IP addresses that have triggered more than 10 failed login events within a single hour, but the events arrive out of order and some hours have no events at all. The analyst wants a row for every hour in the search range, even hours with zero failed logins, so gaps are visible in the report. Which command should be used to produce this result?

Accepted Answer

timechart span=1h count by src_ip fixedrange=t. The requirement is hourly buckets that include empty hours. The timechart command with fixedrange=t guarantees a row for every bucket in the selected time range, even when no events fall into that bucket. Splitting by src_ip preserves per-IP counts, and span=1h sets the bucket size, so the analyst gets a complete hourly timeline with zero-count gaps visible.

Answer

timechart span=1h count by src_ip

Answer

stats count by src_ip, date_hour

Answer

bin _time span=1h | stats count by _time, src_ip

Question 11

A Splunk user needs to display the top 10 source IP addresses by number of failed login attempts, but also wants to see the percentage of total failed logins that each IP represents. Which command should be used to achieve this in one step?

Accepted Answer

stats count by src_ip | eventstats sum(count) as total | eval percent=count/total*100 | sort - count | head 10. To show top 10 source IPs by failed login count and their percentage of total failed logins, you need to aggregate counts, compute the total, calculate percentages, and then sort and limit. The combination of stats, eventstats, eval, sort, and head achieves this in one pipeline.

Answer

top limit=10 src_ip

Answer

rare limit=10 src_ip

Answer

stats count by src_ip | top limit=10 src_ip

Question 12

A security analyst runs a search that returns web access logs with fields clientip, status, and bytes. They need to produce a table where each row shows a clientip, the total number of requests from that clientip, and the total bytes transferred by that clientip, but they also need to retain the original status field for each event for later filtering. Which command should they use?

Accepted Answer

eventstats sum(bytes) AS total_bytes count AS request_count BY clientip. The requirement is to keep each original event (with its status field) while adding per-clientip aggregates. eventstats is designed for exactly this: it calculates aggregates and appends them to every event, unlike stats which replaces events with grouped results, streamstats which calculates running totals, or transaction which merges events.

Answer

streamstats sum(bytes) AS total_bytes count AS request_count BY clientip

Answer

transaction clientip maxspan=1h

Answer

stats sum(bytes) AS total_bytes count AS request_count BY clientip, status

Question 13

A Splunk power user is analyzing web server logs and needs to create a report that shows the top 5 referring domains for each HTTP status code. The user wants to use a single search that returns a table with columns for status, referer_domain, and count, sorted by status and then by count descending. Which TWO commands are essential to achieve this? (Choose two.)

Accepted Answer

top limit=5 referer_domain BY status. To generate a top-N per group report, the search must first aggregate counts by the grouping fields using stats count BY status, referer_domain. Then, the top command with limit=5 and BY status selects the five most frequent referer_domain values for each status code. Together, these commands produce the desired table sorted by status and count.

Answer

eventstats count BY status, referer_domain

Answer

dedup status

Answer

sort - count

Question 14

An administrator is building a search to correlate authentication failures with subsequent successful logins from the same user. The base search returns events with fields user, action, and _time. The administrator wants to identify users who had a failure followed by a success within 10 minutes, but the events may arrive out of order. Which approach is most appropriate?

Accepted Answer

Use the sequence command with a 10-minute time constraint to match failure followed by success.. Detecting an ordered pattern of a failure followed by a success within a time window requires a command that understands sequence and time constraints. The sequence command is built for this purpose, whereas transaction, stats, and streamstats do not enforce the specific order and time proximity needed for this correlation.

Answer

Use streamstats with a window and eval to track the previous action for each user.

Answer

Use transaction user maxspan=10m to group failures and successes into a single event.

Answer

Use stats count BY user, action to count failures and successes separately.

Question 15

A power user is analyzing application logs and needs to identify patterns where a specific error message is followed by a successful transaction within 30 seconds. The logs contain fields 'timestamp', 'message', and 'transaction_id'. Which two commands or techniques are appropriate for this correlation? (Choose two.)

Accepted Answer

transaction transaction_id maxspan=30s startswith=message="ERROR" endswith=message="SUCCESS". The transaction command is the primary tool for correlating events based on time and sequence. Using startswith and endswith with maxspan precisely defines the pattern of ERROR followed by SUCCESS within 30 seconds. Alternatively, using maxpause=30s groups events that are close in time, which can also identify such sequences, though it may include additional events. Both approaches leverage transaction's ability to group related events by a common field and time constraints.

Answer

Use streamstats with a window and eval to compare timestamps of ERROR and SUCCESS events.

Answer

Use the sequence command with a 30-second window to detect ERROR followed by SUCCESS.

Answer

join transaction_id [ search message="SUCCESS" ] | where _time - orig_time <= 30

Question 16

A Splunk administrator is building a report that shows the total count of events per sourcetype for the last 24 hours, but the report must display the sourcetype names in uppercase and also include a column showing the percentage of total events that each sourcetype represents. The report should be sorted so the sourcetype with the highest count appears first. Which sequence of commands achieves this requirement?

Accepted Answer

stats count by sourcetype | eval sourcetype=upper(sourcetype) | eventstats sum(count) as total | eval percent=round(count/total*100,2) | sort - count. The correct pipeline aggregates counts per sourcetype, then modifies the sourcetype values to uppercase, calculates the grand total across all rows using eventstats, computes each row's percentage of that total, and sorts descending by count. This order ensures the percentage calculation has the total available and the final report meets the formatting and sorting requirements.

Answer

stats count by sourcetype | eval percent=count/sum(count)*100 | eval sourcetype=upper(sourcetype) | sort - count

Answer

stats count by sourcetype | eval sourcetype=upper(sourcetype) | addtotals | eval percent=count/total*100 | sort - count

Answer

stats count by sourcetype | eventstats sum(count) as total | eval percent=round(count/total*100,2) | eval sourcetype=upper(sourcetype) | sort count

Question 17

A security analyst needs to display the top 10 source IP addresses by event count, but also include a column showing the percentage each IP contributes to the total. The source IP field is named 'src_ip'. Which search correctly produces this output?

Accepted Answer

index=security | stats count by src_ip | sort - count | head 10 | eventstats sum(count) as total | eval percent = round((count/total)*100,2) | fields src_ip, count, percent. To display the top 10 source IPs by count along with their percentage of the total, you need to first aggregate counts, limit to the top 10, then compute the total of those counts and derive percentages. The 'eventstats' command adds the total to each row without collapsing results, and 'eval' calculates the percentage. The 'fields' command ensures only the desired columns are shown. This pattern is flexible and allows custom formatting, unlike 'top' which provides a fixed output.

Answer

index=security | top limit=10 src_ip

Answer

index=security | stats count by src_ip | sort - count | head 10

Answer

index=security | top limit=10 src_ip | eval percent = round((count/total)*100,2)

Question 18

A performance analyst needs to calculate the 95th percentile of response times for each service, but only for requests that completed successfully. The events contain fields service, response_time, and status_code. They also want to include a count of successful requests per service. Which search should they use?

Accepted Answer

search status_code=200 | stats p95(response_time) AS p95_rt count AS success_count BY service. To calculate metrics only for successful requests, the filtering must occur before the aggregation. Using a base search with status_code=200 followed by stats ensures that only successful requests are included in the percentile and count calculations, grouped by service.

Answer

stats p95(response_time) AS p95_rt count AS success_count BY service

Answer

stats p95(response_time) AS p95_rt count AS success_count BY service | where status_code=200

Answer

eventstats p95(response_time) AS p95_rt count AS success_count BY service | search status_code=200

Question 19

A Splunk power user is analyzing web access logs and wants to create a report that shows, for each HTTP status code, the number of events and the average response time. The report should also include a row that summarizes the overall average response time across all status codes. The user wants the final output to have columns status, count, avg_response_time, and a final row labeled 'Overall' with the overall average. Which command should be used to add the summary row?

Accepted Answer

stats count avg(response_time) as avg_response_time by status | appendpipe [stats avg(avg_response_time) as avg_response_time | eval status="Overall"]. To add a summary row that calculates an overall average from already aggregated results, appendpipe is the appropriate command because it runs a subpipeline on the current result set. The subpipeline can compute the average of the per-status averages and assign a label. The other commands either add a column instead of a row, sum instead of average, or search raw events instead of the aggregated results.

Answer

stats count avg(response_time) as avg_response_time by status | addtotals

Answer

stats count avg(response_time) as avg_response_time by status | append [stats avg(response_time) as avg_response_time | eval status="Overall"]

Answer

stats count avg(response_time) as avg_response_time by status | eventstats avg(avg_response_time) as overall_avg | eval status=if(isnull(status),"Overall",status)

Question 20

A Splunk administrator is reviewing a search that uses the xyseries command to format results for a chart. The search is: index=web | stats count BY status, host | xyseries status host count. Which two statements are true about how xyseries behaves in this scenario? (Choose two.)

Accepted Answer

xyseries can be used to pivot data so that each unique value of the y-axis field becomes a separate column.. xyseries is a transforming command that pivots data into a matrix format. It requires three fields: x-axis, y-axis, and data values. It does not sort or aggregate automatically; those steps must be performed beforehand. It also does not rename the data field. The correct statements reflect its core behavior in pivoting and its argument requirements.

Answer

If there are duplicate combinations of x-axis and y-axis values, xyseries will sum the data values by default.

Answer

xyseries will automatically sort the x-axis values in ascending order.

Answer

xyseries will automatically rename the data field to 'value' in the output.