SPLK-1004 Transforming Commands And Formatting Practice Test 2 — 15 Questions

Question 1

A Splunk administrator is building a report that shows the total count of events per sourcetype for the last 24 hours, but the report must display the sourcetype names in uppercase and also include a column showing the percentage of total events that each sourcetype represents. The report should be sorted so the sourcetype with the highest count appears first. Which sequence of commands achieves this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

stats count by sourcetype | eval sourcetype=upper(sourcetype) | eventstats sum(count) as total | eval percent=round(count/total*100,2) | sort - count. The correct pipeline aggregates counts per sourcetype, then modifies the sourcetype values to uppercase, calculates the grand total across all rows using eventstats, computes each row's percentage of that total, and sorts descending by count. This order ensures the percentage calculation has the total available and the final report meets the formatting and sorting requirements.

Answer

stats count by sourcetype | eval percent=count/sum(count)*100 | eval sourcetype=upper(sourcetype) | sort - count

Answer

stats count by sourcetype | eval sourcetype=upper(sourcetype) | addtotals | eval percent=count/total*100 | sort - count

Answer

stats count by sourcetype | eventstats sum(count) as total | eval percent=round(count/total*100,2) | eval sourcetype=upper(sourcetype) | sort count

Question 2

A security analyst needs to display the top 10 source IP addresses by event count, but also include a column showing the percentage each IP contributes to the total. The source IP field is named 'src_ip'. Which search correctly produces this output?

Accepted Answer

index=security | stats count by src_ip | sort - count | head 10 | eventstats sum(count) as total | eval percent = round((count/total)*100,2) | fields src_ip, count, percent. To display the top 10 source IPs by count along with their percentage of the total, you need to first aggregate counts, limit to the top 10, then compute the total of those counts and derive percentages. The 'eventstats' command adds the total to each row without collapsing results, and 'eval' calculates the percentage. The 'fields' command ensures only the desired columns are shown. This pattern is flexible and allows custom formatting, unlike 'top' which provides a fixed output.

Answer

index=security | top limit=10 src_ip

Answer

index=security | stats count by src_ip | sort - count | head 10

Answer

index=security | top limit=10 src_ip | eval percent = round((count/total)*100,2)

Question 3

A performance analyst needs to calculate the 95th percentile of response times for each service, but only for requests that completed successfully. The events contain fields service, response_time, and status_code. They also want to include a count of successful requests per service. Which search should they use?

Accepted Answer

search status_code=200 | stats p95(response_time) AS p95_rt count AS success_count BY service. To calculate metrics only for successful requests, the filtering must occur before the aggregation. Using a base search with status_code=200 followed by stats ensures that only successful requests are included in the percentile and count calculations, grouped by service.

Answer

stats p95(response_time) AS p95_rt count AS success_count BY service

Answer

stats p95(response_time) AS p95_rt count AS success_count BY service | where status_code=200

Answer

eventstats p95(response_time) AS p95_rt count AS success_count BY service | search status_code=200

Question 4

A Splunk power user is analyzing web access logs and wants to create a report that shows, for each HTTP status code, the number of events and the average response time. The report should also include a row that summarizes the overall average response time across all status codes. The user wants the final output to have columns status, count, avg_response_time, and a final row labeled 'Overall' with the overall average. Which command should be used to add the summary row?

Accepted Answer

stats count avg(response_time) as avg_response_time by status | appendpipe [stats avg(avg_response_time) as avg_response_time | eval status="Overall"]. To add a summary row that calculates an overall average from already aggregated results, appendpipe is the appropriate command because it runs a subpipeline on the current result set. The subpipeline can compute the average of the per-status averages and assign a label. The other commands either add a column instead of a row, sum instead of average, or search raw events instead of the aggregated results.

Answer

stats count avg(response_time) as avg_response_time by status | addtotals

Answer

stats count avg(response_time) as avg_response_time by status | append [stats avg(response_time) as avg_response_time | eval status="Overall"]

Answer

stats count avg(response_time) as avg_response_time by status | eventstats avg(avg_response_time) as overall_avg | eval status=if(isnull(status),"Overall",status)

Question 5

A Splunk administrator is reviewing a search that uses the xyseries command to format results for a chart. The search is: index=web | stats count BY status, host | xyseries status host count. Which two statements are true about how xyseries behaves in this scenario? (Choose two.)

Accepted Answer

xyseries can be used to pivot data so that each unique value of the y-axis field becomes a separate column.. xyseries is a transforming command that pivots data into a matrix format. It requires three fields: x-axis, y-axis, and data values. It does not sort or aggregate automatically; those steps must be performed beforehand. It also does not rename the data field. The correct statements reflect its core behavior in pivoting and its argument requirements.

Answer

If there are duplicate combinations of x-axis and y-axis values, xyseries will sum the data values by default.

Answer

xyseries will automatically sort the x-axis values in ascending order.

Answer

xyseries will automatically rename the data field to 'value' in the output.

Question 6

A Splunk user wants to create a table that shows the number of failed login attempts per user, but only for users who have more than 5 failed attempts. The events contain a field 'user' and 'action' with value 'failed'. Which search achieves this?

Accepted Answer

index=security action=failed | stats count by user | where count > 5. To filter aggregated results, the 'where' command is used after a transforming command like 'stats'. It allows comparison operators on fields created by 'stats', such as 'count'. The search first counts failed login attempts per user, then filters to those with a count greater than 5. This is the most straightforward and efficient method. Other options either use incorrect syntax or unnecessarily complex logic.

Answer

index=security action=failed | stats count by user | search count > 5

Answer

index=security action=failed | stats count by user | head 5

Answer

index=security action=failed | stats count by user | eval count=if(count>5, count, null) | where isnull(count)=0

Question 7

A Splunk user has a search that returns events with a field named 'duration' in milliseconds. The user wants to display the duration in a more readable format, such as '1.5s' or '2m 30s', without changing the underlying numeric value used for calculations. Which command should the user employ to create a new field called 'readable_duration' that contains the formatted string?

Accepted Answer

eval readable_duration = case(duration < 1000, duration . "ms", duration < 60000, round(duration/1000,1) . "s", true(), round(duration/60000,1) . "m"). To create a human-readable duration string from a numeric millisecond field without losing the numeric field, the user should use eval with conditional logic. The case function can branch on thresholds and concatenate the converted value with a unit label. This approach preserves the original field for calculations and produces a formatted string in a new field. Other commands either misinterpret the unit or do not provide the desired format.

Answer

eval readable_duration = strftime(duration, "%H:%M:%S")

Answer

convert duration to readable_duration

Answer

eval readable_duration = tostring(duration, "duration")

Question 8

A Splunk power user is working with a dataset that contains a field named 'product_id' and a field named 'product_name'. The user needs to create a new field that combines these two fields into a single string in the format 'product_id: product_name', and also needs to ensure that if either field is null, the combined field shows 'Unknown' instead of a partial string. Which two eval expressions will correctly produce the desired combined field? (Choose two.)

Accepted Answer

eval combined = if(isnull(product_id) OR isnull(product_name), "Unknown", product_id . ": " . product_name). The requirement is to combine two fields with a specific format and to output 'Unknown' if either field is missing. The if function with an OR condition and the case function with an OR condition both correctly check for null in either field before concatenating. The coalesce approach substitutes nulls individually, producing partial strings, while the AND condition only catches the case where both are null. The fillnull approach does not fix partial concatenations.

Answer

eval combined = coalesce(product_id, "Unknown") . ": " . coalesce(product_name, "Unknown")

Answer

eval combined = if(isnull(product_id) AND isnull(product_name), "Unknown", product_id . ": " . product_name)

Answer

eval combined = product_id . ": " . product_name | fillnull value="Unknown" combined

Question 9

A Splunk power user runs a search that returns a field named duration_ms with values such as 1250 and 3400. They need to display this field in a table as a three-digit decimal number of seconds, rounded to two decimal places, without altering the underlying events. Which command should they use?

Accepted Answer

eval seconds=round(duration_ms/1000, 2). The eval command is the correct choice because it can calculate a new field using arithmetic and the round function. Dividing milliseconds by 1000 and rounding to two decimal places yields the desired seconds display without changing indexed data. The other commands either do not perform arithmetic or do not produce the requested numeric format.

Answer

rex field=duration_ms "(?<seconds>\d+)"

Answer

convert dur2sec(duration_ms) AS seconds

Answer

fieldformat seconds=duration_ms/1000

Question 10

A Splunk power user has a search that returns events with a field named status_code. They need to replace every occurrence of the value 404 with Not Found and every occurrence of 500 with Server Error in the displayed results, while leaving all other values unchanged. Which command accomplishes this with the least effort?

Accepted Answer

replace 404 WITH "Not Found", 500 WITH "Server Error" IN status_code. The replace command is purpose-built for substituting values within a field. Its syntax allows multiple replacements separated by commas, and it preserves values that are not listed. This directly satisfies the need to change only 404 and 500 to descriptive text while leaving all other status codes as they are.

Answer

rex field=status_code "(?<status_code>404|500)"

Answer

eval status_code=case(status_code==404, "Not Found", status_code==500, "Server Error")

Answer

lookup status_code_lookup status_code OUTPUT new_status

Question 11

A Splunk power user is preparing a report and needs to rename the field src_ip to Source Address and the field dest_ip to Destination Address in the final results, without changing the underlying field values. The user also wants to ensure that if either field is missing, the search does not fail but simply omits the renamed field. Which two commands can achieve the renaming? (Choose two.)

Accepted Answer

rename src_ip AS "Source Address" dest_ip AS "Destination Address". Both rename and eval can change field names in search results. The rename command directly renames fields and tolerates missing fields. Alternatively, eval can create new fields with the desired names and then remove the originals with fields -; missing source fields result in null values that are effectively omitted. The other commands either do not support renaming or are not designed for that purpose.

Answer

fields src_ip AS "Source Address" dest_ip AS "Destination Address"

Answer

table src_ip AS "Source Address" dest_ip AS "Destination Address"

Answer

convert src_ip AS "Source Address" dest_ip AS "Destination Address"

Question 12

A Splunk power user has a search that returns a field named product_id containing values like 1001, 1002, and 1003. They need to add a new field named product_category that maps 1001 to Hardware, 1002 to Software, and 1003 to Services, and should be Unknown for any other product_id. Which command should they use?

Accepted Answer

eval product_category=case(product_id==1001, "Hardware", product_id==1002, "Software", product_id==1003, "Services", true(), "Unknown"). The case function is designed for multi-condition mapping with a default. It checks each condition in order and returns the corresponding value, falling back to the final true() condition when no other matches. This cleanly maps the three product IDs and assigns Unknown to all others, which is exactly what the scenario requires.

Answer

eval product_category=coalesce(product_id, "Unknown")

Answer

eval product_category=lookup(product_id, "1001", "Hardware", "1002", "Software", "1003", "Services")

Answer

eval product_category=if(product_id==1001, "Hardware", if(product_id==1002, "Software", if(product_id==1003, "Services", "Unknown")))

Question 13

A Splunk power user needs to display a table of web access logs where the status field is shown as either Success or Failure based on whether the status code is less than 400 or not. The user also wants to ensure that the original status field remains available for further calculations later in the search. Which command should they use?

Accepted Answer

eval status_display=if(status<400, "Success", "Failure"). Using eval to create a new field with the if function preserves the original status field for later calculations while providing the Success/Failure display. Overwriting the original field or using replace would lose the numeric values, and fieldformat does not create a separate field. The eval approach is the only one that meets both requirements.

Answer

fieldformat status=if(status<400, "Success", "Failure")

Answer

replace 200 WITH "Success", 404 WITH "Failure" IN status

Answer

eval status=if(status<400, "Success", "Failure")

Question 14

How do you calculate the percentage of total events for each status code?

Accepted Answer

stats count by status | eventstats sum(count) as total | eval percent = (count/total)*100. The correct answer uses stats count by status to get counts per status, then eventstats sum(count) as total to compute the total across all events, and finally eval percent = (count/total)*100 to calculate the percentage. This is the standard Splunk pattern for percentage-of-total calculations because eventstats adds the aggregate total to each row without collapsing results. The combination ensures each status code's percentage is correctly derived from the overall event count.

Answer

stats count(status) as total

Answer

stats count by status | eval percent = count/total

Answer

chart count by status | addtotals

Question 15

When using 'chart', what is the behavior if you do not specify a 'by' clause?

Accepted Answer

It creates a single-series chart for the entire result set.. When you use the chart command without a 'by' clause, Splunk produces a single-series chart that aggregates the entire result set into one row/series. The chart command requires at least one aggregation function (e.g., count, sum) and without a 'by' clause it simply applies that function to all events, returning one data point per aggregation.

Answer

It returns an error.

Answer

It defaults to the first field found.

Answer

It returns the same as 'stats'.