SPLK-1004 Transforming Commands And Formatting Practice Test 4 — 15 Questions

Question 1

What is the result of 'transaction' command compared to 'stats'?

Accepted Answer

Transaction groups events by time and common fields.. The transaction command groups events that share common field values (like a session ID or transaction ID) and occur within a maximum time span (maxspan) or pause between events (maxpause), producing one row per transaction. In contrast, stats aggregates events into metrics (count, avg, sum) grouped by fields, without the time-bounded grouping semantics.

Answer

Transaction is for reporting only.

Answer

Transaction is always faster than stats.

Answer

Stats can only be used with time.

Question 2

Which TWO of the following commands are considered 'transforming' commands?

Accepted Answer

timechart. In Splunk's Search Processing Language (SPL), transforming commands are those that order the results into a data table, typically aggregating or grouping events into statistical output — and both A (timechart) and B (stats) do exactly this. The timechart command is a transforming command because it aggregates events into a time-series table, bucketing by _time and splitting by a field to produce statistical values per time interval. The stats command is likewise transforming because it computes aggregations (such as count, sum, avg, dc) and returns a tabular result set grouped by specified by-clauses. By contrast, C (rex) is a field-extraction command that only adds fields to events without restructuring them into a table, D (fields) is a filtering/field-selection command that includes or excludes fields, and E (where) is a filtering command that evaluates a boolean expression to keep or drop events — none of these transform the result set into statistical tabular output.

Answer

rex

Answer

fields

Answer

where

Question 3

Which THREE of the following are valid aggregation functions used with 'stats'?

Accepted Answer

dc. The 'stats' command in Splunk supports aggregation functions such as dc (distinct count), avg (average), and count, so options A, C, and D are all valid. Option A, dc, is correct because it returns the number of distinct values for a field, e.g., 'stats dc(user)'. Option C, avg, is correct because it computes the arithmetic mean of a numeric field, e.g., 'stats avg(response_time)'. Option D, count, is correct because it counts the number of events or occurrences, e.g., 'stats count by host'. Option B, where, is not an aggregation function; it is a filtering command used to filter search results based on a condition. Option E, rename, is not an aggregation function; it is a command used to rename fields in the results.

Answer

where

Answer

rename

Question 4

Which TWO actions can be performed by the 'eval' command?

Accepted Answer

Concatenating strings. Option B is correct because the eval command can concatenate strings using functions such as + or the concatenation operator, for example eval full_name = first_name . " " . last_name, which builds a new field from existing string values. Option C is correct because eval is specifically designed to perform mathematical calculations, such as eval total = price * quantity, using arithmetic operators and functions like round() or abs(). The other options do not belong: eval does not create new data inputs (that is done by inputs.conf or data ingestion), it cannot change user permissions (that is handled by role and user management), and it cannot remove events from the index (that requires delete or index management commands).

Answer

Creating new data inputs

Answer

Changing user permissions

Answer

Removing events from the index

Question 5

Which TWO of the following are true about 'eventstats'?

Accepted Answer

It calculates aggregates for each event.. Option C is correct because eventstats computes aggregate values (e.g., avg, sum, count) and then enriches each individual event with those results, effectively calculating the aggregate in the context of every event rather than collapsing them. Option D is correct because eventstats appends new fields containing the aggregate values to all events in the result set, preserving the original events while adding the computed statistics. Options A, B, and E are incorrect: eventstats is generally slower than stats because it must retain and enrich every event rather than reducing the result set; it does not remove non-aggregated fields (that describes stats behavior); and it does not replace existing events, it augments them.

Answer

It is faster than stats.

Answer

It removes non-aggregated fields.

Answer

It replaces the existing events.

Question 6

Which TWO are common causes for a 'transaction' command taking too long?

Accepted Answer

The number of unique group values is high.. Option B is correct because a high number of unique group values forces the search engine to create and track many distinct groups, which increases memory usage and processing time for the transaction command. Option C is correct because searching over a very large time range requires scanning more events, which directly increases the time needed to complete the transaction. Option A is incorrect because lacking admin privileges affects permissions, not transaction execution speed. Option D is incorrect because JSON is simply a data format and does not inherently slow down a transaction. Option E is incorrect because using fewer commands would generally reduce, not increase, processing time.

Answer

The user is not an admin.

Answer

The data is in JSON format.

Answer

The search uses too few commands.

Question 7

Which TWO are true about the 'eval' command?

Accepted Answer

It can be used to perform logical evaluations.. Option B is correct because the 'eval' command in Splunk can perform logical evaluations, such as using if(), case(), or comparison operators to produce boolean or conditional results. Option E is also correct because 'eval' is commonly used to perform math operations, including arithmetic on numeric fields or expressions, and to assign the result to a new or existing field. Option A is incorrect because 'eval' does create new fields when you specify a field name on the left side of the expression, such as 'eval total=price*qty'. Option C is incorrect because 'eval' is not a generating command; generating commands like 'makeresults' or 'tstats' create events or results, whereas 'eval' is a streaming/eval command that operates on existing results. Option D is incorrect because filtering events is done by search commands such as 'search', 'where', or 'filter', not by 'eval' itself.

Answer

It does not create new fields.

Answer

It is a generating command.

Answer

It is used to filter events.

Question 8

Which THREE of the following functions are used with 'stats' to aggregate data?

Accepted Answer

max. The 'stats' command in Splunk aggregates events and supports statistical functions such as max, count, and sum. Option A (max) is correct because max returns the highest value of a numeric field across the grouped events. Option B (count) is correct because count tallies the number of events in each group, which is a core aggregation. Option E (sum) is correct because sum adds the values of a numeric field across events in each group. Option C (eval) is not a stats function; it is a separate command used to calculate or transform field values. Option D (search) is also not a stats function; it is a command used to filter events, not to aggregate them.

Answer

eval

Answer

search

Question 9

A security analyst needs to correlate failed login events with subsequent successful logins from the same source IP within a 10-minute window. The raw events contain src_ip and action fields but no session identifier. Which Splunk transforming command should the analyst use to group these events into sessions based on time proximity?

Accepted Answer

transaction. The transaction command is designed to group related events into a single event based on shared field values and time constraints such as maxspan or maxpause. By setting maxpause=10m and grouping by src_ip, the analyst can correlate failed and successful logins that occur within 10 minutes, creating session-like events without needing a pre-existing session identifier.

Answer

stats

Answer

streamstats

Answer

join

Question 10

A security analyst needs to enrich raw firewall logs by attaching the matching department name from a lookup table. The lookup table contains department IDs, and the firewall logs contain a field called dept_id. The analyst wants to add the department name to each event without discarding events that have no matching department ID. Which command should be used?

Accepted Answer

lookup. The lookup command is specifically designed to enrich events with fields from an external lookup table. It matches on a field such as dept_id and adds the corresponding department name. By default, it retains events with no match, which aligns with the requirement to not discard unmatched events.

Answer

append

Answer

join

Answer

transaction

Question 11

A Splunk administrator is building a dashboard panel that must show the total number of events per sourcetype and also include a column showing what percentage each sourcetype contributes to the overall event count. The search already uses stats count by sourcetype. Which approach will add the percentage column correctly in a single search?

Accepted Answer

Append | eventstats sum(count) as total | eval pct=round(count/total*100,2). To add an aggregate value to every existing row without collapsing the result set, eventstats is the correct tool. It calculates the sum of the count field across all sourcetype rows and writes that total into each row. Dividing each row's count by the total and multiplying by 100 produces the percentage contribution while preserving the per-sourcetype breakdown needed for the panel.

Answer

Append | addtotals fieldname=total | eval pct=count/total*100

Answer

Append | stats sum(count) as total | eval pct=round(count/total*100,2)

Answer

Append | top count by sourcetype | eval pct=percent

Question 12

A Splunk power user needs to calculate the total number of events per sourcetype and include a column that shows the percentage of total events each sourcetype represents. The search should return a table with sourcetype, count, and percentage. Which sequence of commands achieves this?

Accepted Answer

stats count BY sourcetype | eventstats sum(count) AS total | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage. To calculate a percentage of total, the search must first aggregate counts per sourcetype using stats, then compute the grand total across all results using eventstats without a BY clause. The eval command then divides each count by the grand total and multiplies by 100. This sequence ensures each row's percentage is based on the overall total, not a running or grouped sum.

Answer

stats count BY sourcetype | eventstats sum(count) AS total BY sourcetype | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage

Answer

stats count BY sourcetype | streamstats sum(count) AS total | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage

Answer

stats count BY sourcetype | addtotals | eval percentage = round((count/total)*100, 2) | table sourcetype count percentage

Question 13

An analyst is reviewing web server logs and needs to display the top 5 URL paths by total bytes transferred. The field 'bytes' is numeric, and 'uri_path' is a string. Which search produces the correct result with the least performance impact?

Accepted Answer

index=web | stats sum(bytes) as total_bytes by uri_path | sort - total_bytes | head 5. To find the top 5 URL paths by total bytes transferred, you need to sum the numeric bytes field for each uri_path and then sort descending. The stats command efficiently groups by uri_path and calculates the sum, producing a compact result set. Sorting and limiting with head gives the top 5. This approach minimizes memory and processing compared to eventstats or chart, which retain more data or add overhead.

Answer

index=web | eventstats sum(bytes) as total_bytes by uri_path | dedup uri_path | sort - total_bytes | head 5

Answer

index=web | top limit=5 bytes by uri_path

Answer

index=web | chart sum(bytes) over uri_path | sort - sum(bytes) | head 5

Question 14

A Splunk user has a search that returns events with a field named status_code containing values like 200, 404, and 500. The user wants to create a new field named status_category that contains the text Success for 200, Client Error for 4xx codes, and Server Error for 5xx codes, without removing the original status_code field. Which eval expression accomplishes this?

Accepted Answer

eval status_category=case(status_code==200, "Success", status_code>=400 AND status_code<500, "Client Error", status_code>=500, "Server Error"). To map multiple numeric ranges to text labels, the case function is appropriate because it evaluates a list of condition-value pairs in order and returns the value for the first true condition. This allows 200 to map to Success, 4xx to Client Error, and 5xx to Server Error in a single eval, while the original status_code field remains available.

Answer

eval status_category=if(status_code==200, "Success", "Error")

Answer

eval status_category=replace(status_code, "200", "Success")

Answer

eval status_category=coalesce(status_code, "Success", "Client Error", "Server Error")

Question 15

A security analyst needs to correlate failed login attempts with subsequent successful logins for the same user within 10 minutes. The relevant events are in the 'auth' index with fields 'user', 'action' (failed or success), and '_time'. Which command should be used to achieve this correlation?

Accepted Answer

transaction user maxspan=10m startswith=action="failed" endswith=action="success". The transaction command is designed to group related events into a single transaction based on a common field and time constraints. By specifying startswith and endswith, it ensures that only sequences beginning with a failed login and ending with a successful login within 10 minutes are grouped. This precisely matches the analyst's need to correlate failed attempts with subsequent successful logins for the same user.

Answer

stats count by user, action | where action="failed" AND action="success"

Answer

join user [ search index=auth action=success ]

Answer

eventstats values(action) as actions by user | where mvcount(actions)>1