SPLK-1002 Advanced Searching and Statistics — 100 Questions

Question 1

A Splunk administrator runs the following search and notices that the results include events where the 'status' field is 200 or 404, but also includes events where the 'status' field is missing. What is the most efficient way to modify the search to exclude events where the 'status' field does not exist?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

status=200 OR status=404 | where isnotnull(status). It uses the `where isnotnull(status)` command after the initial search, which is a valid and efficient way to filter out events where the `status` field does not exist. The `isnotnull()` function returns true if the field exists and is not null, so this ensures only events with a defined `status` field are kept. Option B is incorrect as written because it lacks an AND operator between `NOT ISNULL(status)` and `(status=200 OR status=404)`, making it syntactically invalid. Without the AND, the two conditions are concatenated improperly, causing a parse error. Option A uses `search status!=null`, which is not valid Splunk syntax (Splunk does not support `!=null`). Option D does not filter out missing `status` fields at all.

Answer

status=200 OR status=404 | search status!=null

Answer

NOT ISNULL(status) (status=200 OR status=404)

Answer

status=200 OR status=404

Question 2

A search returns events with a field 'response_time' in milliseconds. The analyst wants to categorize response times into three buckets: 'fast' (< 100), 'medium' (100-500), 'slow' (> 500). Which search correctly creates this categorization?

Accepted Answer

| eval bucket=case(response_time<100,"fast", response_time>=100 AND response_time<=500,"medium", response_time>500,"slow"). Both options A and C correctly create the categorization. Option A uses the `case` function, which evaluates conditions in order and returns the first true result. Option C uses nested `if` statements, which also works because the outer `if` handles the first condition, and the inner `if` handles the remaining range. Option B is incorrect because a single `if` can only handle two outcomes. Option D is inefficient but would produce the same buckets if executed correctly, though it is not the most idiomatic Splunk approach.

Answer

| eval bucket=if(response_time<100,"fast",response_time<500,"medium","slow")

Answer

| where response_time<100 | eval bucket="fast" | append [search where response_time>=100 AND response_time<=500 | eval bucket="medium"]

Question 3

A security analyst needs to find all events where the field `status` has a value of either "error" or "critical" and the field `bytes` is greater than 1000. Which search correctly accomplishes this?

Accepted Answer

status IN (error, critical) AND bytes>1000. The IN operator in Splunk allows checking if a field matches any of the listed values without needing quotes around simple string literals. The explicit AND ensures both conditions are met. Options A and D rely on implicit AND (space) which works but is less explicit. Option B is wrong because AND has higher precedence than OR, leading to incorrect logic.

Answer

(status=error OR status=critical) bytes>1000

Answer

status=error OR status=critical AND bytes>1000

Answer

status="error" OR status="critical" bytes>1000

Question 4

Which TWO of the following statements about the `transaction` command are true? (Choose two.)

Accepted Answer

The transaction command can only be used on events that have a timestamp.. True because every event in Splunk has a timestamp, and the `transaction` command relies on timestamps to group events into transactions. Option C is true because the `transaction` command can group events that share a common field value, such as a session ID, allowing correlation of related events. Option D is true because the `transaction` command adds fields like `duration` and `eventcount` to each transaction. Options B and E are false: B is false because the `transaction` command uses a fixed or pause-based window, not a sliding window; E is false because the `transaction` command does not remove all fields except those specified – it retains fields and adds new ones.

Answer

The transaction command uses a sliding time window to detect transaction boundaries.

Answer

The transaction command removes all fields except those specified in the `fields` argument.

Question 5

A security analyst wants to find all events where the field 'src_ip' matches any IP address in a lookup table named 'malicious_ips.csv'. The lookup has fields 'ip' and 'threat'. Which search correctly enriches events with the threat info and filters to only malicious IPs?

Accepted Answer

`index=security | lookup malicious_ips.csv src_ip OUTPUT threat | where threat!=""`. Both options B and E are correct. Option B uses `lookup malicious_ips.csv src_ip OUTPUT threat | where threat!=""` which effectively enriches events with the threat field and filters to only events where a match occurred. Option E uses `lookup malicious_ips.csv src_ip AS ip OUTPUTNEW threat | where isnotnull(threat)` achieving the same result with minor syntax differences. The other options fail either to enrich properly or to filter correctly: A is inefficient and may not filter reliably, C does not enrich, and D has incorrect lookup syntax.

Answer

`index=security | lookup malicious_ips.csv src_ip | search threat=*`

Answer

`index=security [| inputlookup malicious_ips.csv | fields ip | rename ip as src_ip]`

Answer

`index=security | lookup malicious_ips.csv src_ip AS ip | where isnotnull(threat)`

Question 6

A Splunk administrator runs the following search to identify the top 5 users by total bytes transferred:

index=proxy sourcetype=webproxy
| stats sum(bytes) as total_bytes by user
| sort - total_bytes
| head 5

The search returns results, but the numbers seem inflated. On closer inspection, the 'bytes' field is a string type. What must be done to correct the search?

Accepted Answer

Use 'eval bytes_numeric = tonumber(bytes)' then 'stats sum(bytes_numeric) as total_bytes by user'.. `bytes` is stored as a string. `stats sum()` may not correctly sum string values if they contain non-numeric characters. Using `eval tonumber()` creates a numeric field and safely converts non-numeric values to null (ignored by sum), ensuring accurate totals. While `convert num(bytes)` (Option A) is a valid command, `eval tonumber()` is the preferred method for explicit conversion before statistical aggregations.

Answer

Use 'convert num(bytes)' before stats.

Answer

Use 'where isnum(bytes)' to filter out non-numeric values before stats.

Answer

Use 'eval bytes = string(bytes)' before stats.

Question 7

Which command extracts a field named 'ip' from the raw event using a regex pattern?

Accepted Answer

rex "ip=(?\d+\.\d+\.\d+\.\d+)". The `rex` command uses the named capture group syntax `(?...)` to extract a field named 'ip' from the raw event. The pattern `(?\d+\.\d+\.\d+\.\d+)` matches an IPv4 address and assigns it to the field 'ip'. By default, `rex` operates on the `_raw` field, so no explicit `field=_raw` is needed, and the syntax `(?...)` is the correct Splunk named capture group syntax.

Answer

rex "ip=(?\d+\.\d+\.\d+\.\d+)"

Answer

rex field=_raw "ip=(?P<ip>\d+\.\d+\.\d+\.\d+)"

Answer

rex field=_raw "ip=(?<ip>\d+\.\d+\.\d+\.\d+)"

Question 8

Refer to the exhibit. The search returns 50 results after the `where` command. What is the purpose of the `eval` command?

Accepted Answer

To create a new field 'severity' based on a condition.. The `eval` command in Splunk is used to create new fields or evaluate expressions. In this context, the `eval` command creates a new field called 'severity' by evaluating a conditional expression that assigns a value based on the 'count' field. This is confirmed by the search returning 50 results after the `where` command, meaning the `eval` command does not filter results but instead adds a computed field.

Answer

To filter out results with count ≤ 100.

Answer

To modify the 'count' field.

Answer

To rename the 'count' field to 'severity'.

Question 9

A security analyst needs to find all events where the field 'user' has a value that is either 'admin' or 'root', but the search is returning too many results from a noisy source. Which search best filters the events to only include those where the 'user' field exactly matches 'admin' or 'root'?

Accepted Answer

user=admin OR user=root. Using unquoted field comparisons with the OR operator performs an exact match for simple values like 'admin' and 'root'. In Splunk, when field values do not contain spaces or special characters, unquoted values are treated as exact match tokens. Therefore, `user=admin OR user=root` will retrieve events where the user field is exactly 'admin' or 'root'. Option A is also valid but less concise. Option B uses wildcards, matching any occurrence, not exact. Option C uses the IN operator, which is another exact match method, but option D is equally correct and often considered more straightforward for this simple case.

Answer

user="admin" OR user="root"

Answer

user=*admin* OR user=*root*

Answer

user IN ("admin", "root")

Question 10

An analyst wants to find the top 5 users who have the highest total bytes transferred. The data has fields 'user' and 'bytes'. Which search should be used?

Accepted Answer

| stats sum(bytes) as total_bytes by user | sort - total_bytes | head 5. It uses `stats sum(bytes) as total_bytes by user` to aggregate the total bytes transferred per user, then sorts the results in descending order with `sort - total_bytes`, and finally limits the output to the top 5 users with `head 5`. This directly answers the requirement for the highest total bytes transferred.

Answer

| stats max(bytes) as max_bytes by user | sort - max_bytes | head 5

Answer

| sort - bytes | head 5 | table user, bytes

Answer

| top limit=5 user

Question 11

A search uses 'transaction' to group events by session, but the results show too many transactions with only one event. What is the best way to filter out single-event transactions?

Accepted Answer

| transaction ... | where eventcount > 1. The `transaction` command groups events into transactions, and appending `| where eventcount > 1` filters out any transaction that consists of only a single event. This directly addresses the requirement to remove single-event transactions, as `eventcount` is a default field added by `transaction` that counts the number of events in each transaction.

Answer

Add maxspan=5m to the transaction command

Answer

| transaction maxevents=2 ...

Answer

| transaction ... | where eventcount=2

Question 12

Which TWO of the following statements about the 'stats' command are true?

Accepted Answer

It can be used with a BY clause to group results.. The 'stats' command in Splunk supports a BY clause that allows you to group results by one or more fields, similar to a SQL GROUP BY. This enables you to compute aggregate statistics (e.g., count, sum, avg) for each distinct value of the specified field(s), which is a core feature for summarizing event data.

Answer

The count() function must always include a field argument.

Answer

It creates one event per input event by default.

Answer

It can be used to modify individual field values in raw events.

Question 13

Which THREE of the following are valid Splunk search commands for determining the number of distinct values of a field?

Accepted Answer

| stats dc(field). `| stats dc(field)` uses the `dc` (distinct count) function to return the exact number of unique values for the specified field. This is the direct and most efficient command for counting distinct values in Splunk.

Answer

| stats count(field)

Answer

| stats distinct_count(field)

Question 14

The search returns zero results, but the lookup file contains users with names like 'admin1', 'admin2'. What is the most likely reason?

Accepted Answer

The 'like' function requires a wildcard pattern with '%' but the field value may have leading/trailing spaces or the pattern is case-sensitive.. The 'like' function in Splunk uses SQL-style pattern matching where '%' matches any sequence of characters. If the lookup file contains 'admin1' and 'admin2', but the search uses 'like(role, "admin%")', leading/trailing spaces in the field values or case sensitivity (e.g., 'Admin1' vs 'admin1') would cause the pattern to fail, returning zero results. Option B correctly identifies this as the most likely reason because Splunk's 'like' is case-sensitive by default and does not trim spaces.

Answer

The lookup file is not in CSV format.

Answer

The stats command only counts events where role=admin, but the role field is already filtered.

Answer

The search command runs before the eval command.

Question 15

The search returns unexpected results, including IP addresses that are not in the expected format (e.g., '127.0.0.1' appears as '27.0.0.1'). What is the most likely cause?

Accepted Answer

The rex command extracts the first match only; some events may have multiple IPs and the first one is not the full IP.. The `rex` command, by default, extracts only the first match of a regex pattern from each event. If an event contains multiple IP addresses, `rex` captures the first occurrence, which may be truncated if the regex pattern is not anchored properly or if the IP appears in a context where leading digits are separated (e.g., '127.0.0.1' might be preceded by a character that causes the regex to match starting at '27.0.0.1'). This is a common behavior in Splunk when using `rex` without the `max_match` parameter.

Answer

The regex pattern is incorrect; it should use \b for word boundaries.

Answer

The top command is modifying the extracted ip field.

Answer

The rex command must be placed before the index search.

Question 16

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 17

A search returns many events, and the analyst wants to see a summary table of the top 5 values of the field `src_ip` along with the count of events for each. Which command should be used?

Accepted Answer

top. The `top` command in Splunk is specifically designed to find the most common values of a field and display them in a summary table with counts and percentages. By default, `top` returns the top 10 values, but you can use the `limit=5` parameter to restrict the output to the top 5 values of `src_ip` along with their event counts. This directly meets the analyst's requirement.

Answer

eventstats

Answer

sort

Answer

rare

Question 18

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 19

An analyst wants to create a timechart of the count of events per hour, but only for events where the field `status` contains the word "fail" (case-insensitive). Which search is correct?

Accepted Answer

index=main | timechart count by eval(case(match(status,"(?i)fail"),1)). It uses `eval` with `case` and `match` to create a field that is 1 when `status` contains 'fail' (case-insensitive via `(?i)`), then uses `timechart count by` that field to count only matching events per hour. This approach correctly filters within the timechart aggregation, ensuring only events where status matches the pattern are counted.

Answer

index=main | timechart count | search status=*fail*

Answer

index=main | regex status="fail" | timechart count

Answer

index=main | where status="*fail*" | timechart count

Question 20

Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)

Accepted Answer

... | map search="search index=other $field$". The `map` command in SPL allows you to run a subsearch for each result of the outer search, using field values from the outer result (e.g., `$field$`) to dynamically construct the inner search. This is a valid way to create a subsearch that iterates over search results, making it a legitimate subsearch pattern in Splunk.

Answer

... | join type=inner [search index=other]

Answer

[return index=main | stats count]