SPLK-1002 Advanced Searching and Statistics — 15 Questions

Question 1

A security analyst needs to find all events where the field 'user' has a value that is either 'admin' or 'root', but the search is returning too many results from a noisy source. Which search best filters the events to only include those where the 'user' field exactly matches 'admin' or 'root'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

user=admin OR user=root. Using unquoted field comparisons with the OR operator performs an exact match for simple values like 'admin' and 'root'. In Splunk, when field values do not contain spaces or special characters, unquoted values are treated as exact match tokens. Therefore, `user=admin OR user=root` will retrieve events where the user field is exactly 'admin' or 'root'. Option A is also valid but less concise. Option B uses wildcards, matching any occurrence, not exact. Option C uses the IN operator, which is another exact match method, but option D is equally correct and often considered more straightforward for this simple case.

Answer

user="admin" OR user="root"

Answer

user=*admin* OR user=*root*

Answer

user IN ("admin", "root")

Question 2

A Splunk administrator runs the following search and notices that the results include events where the 'status' field is 200 or 404, but also includes events where the 'status' field is missing. What is the most efficient way to modify the search to exclude events where the 'status' field does not exist?

Accepted Answer

status=200 OR status=404 | where isnotnull(status). It uses the `where isnotnull(status)` command after the initial search, which is a valid and efficient way to filter out events where the `status` field does not exist. The `isnotnull()` function returns true if the field exists and is not null, so this ensures only events with a defined `status` field are kept. Option B is incorrect as written because it lacks an AND operator between `NOT ISNULL(status)` and `(status=200 OR status=404)`, making it syntactically invalid. Without the AND, the two conditions are concatenated improperly, causing a parse error. Option A uses `search status!=null`, which is not valid Splunk syntax (Splunk does not support `!=null`). Option D does not filter out missing `status` fields at all.

Answer

status=200 OR status=404 | search status!=null

Answer

NOT ISNULL(status) (status=200 OR status=404)

Answer

status=200 OR status=404

Question 3

A search returns events with a field 'response_time' in milliseconds. The analyst wants to categorize response times into three buckets: 'fast' (< 100), 'medium' (100-500), 'slow' (> 500). Which search correctly creates this categorization?

Accepted Answer

| eval bucket=case(response_time<100,"fast", response_time>=100 AND response_time<=500,"medium", response_time>500,"slow"). Both options A and C correctly create the categorization. Option A uses the `case` function, which evaluates conditions in order and returns the first true result. Option C uses nested `if` statements, which also works because the outer `if` handles the first condition, and the inner `if` handles the remaining range. Option B is incorrect because a single `if` can only handle two outcomes. Option D is inefficient but would produce the same buckets if executed correctly, though it is not the most idiomatic Splunk approach.

Answer

| eval bucket=if(response_time<100,"fast",response_time<500,"medium","slow")

Answer

| where response_time<100 | eval bucket="fast" | append [search where response_time>=100 AND response_time<=500 | eval bucket="medium"]

Question 4

Which THREE of the following are valid Splunk search commands for determining the number of distinct values of a field?

Accepted Answer

| stats dc(field). `| stats dc(field)` uses the `dc` (distinct count) function to return the exact number of unique values for the specified field. This is the direct and most efficient command for counting distinct values in Splunk.

Answer

| stats count(field)

Answer

| stats distinct_count(field)

Question 5

The search returns zero results, but the lookup file contains users with names like 'admin1', 'admin2'. What is the most likely reason?

Accepted Answer

The 'like' function requires a wildcard pattern with '%' but the field value may have leading/trailing spaces or the pattern is case-sensitive.. The 'like' function in Splunk uses SQL-style pattern matching where '%' matches any sequence of characters. If the lookup file contains 'admin1' and 'admin2', but the search uses 'like(role, "admin%")', leading/trailing spaces in the field values or case sensitivity (e.g., 'Admin1' vs 'admin1') would cause the pattern to fail, returning zero results. Option B correctly identifies this as the most likely reason because Splunk's 'like' is case-sensitive by default and does not trim spaces.

Answer

The lookup file is not in CSV format.

Answer

The stats command only counts events where role=admin, but the role field is already filtered.

Answer

The search command runs before the eval command.

Question 6

The search returns unexpected results, including IP addresses that are not in the expected format (e.g., '127.0.0.1' appears as '27.0.0.1'). What is the most likely cause?

Accepted Answer

The rex command extracts the first match only; some events may have multiple IPs and the first one is not the full IP.. The `rex` command, by default, extracts only the first match of a regex pattern from each event. If an event contains multiple IP addresses, `rex` captures the first occurrence, which may be truncated if the regex pattern is not anchored properly or if the IP appears in a context where leading digits are separated (e.g., '127.0.0.1' might be preceded by a character that causes the regex to match starting at '27.0.0.1'). This is a common behavior in Splunk when using `rex` without the `max_match` parameter.

Answer

The regex pattern is incorrect; it should use \b for word boundaries.

Answer

The top command is modifying the extracted ip field.

Answer

The rex command must be placed before the index search.

Question 7

A security analyst needs to find all events where the field `status` has a value of either "error" or "critical" and the field `bytes` is greater than 1000. Which search correctly accomplishes this?

Accepted Answer

status IN (error, critical) AND bytes>1000. The IN operator in Splunk allows checking if a field matches any of the listed values without needing quotes around simple string literals. The explicit AND ensures both conditions are met. Options A and D rely on implicit AND (space) which works but is less explicit. Option B is wrong because AND has higher precedence than OR, leading to incorrect logic.

Answer

(status=error OR status=critical) bytes>1000

Answer

status=error OR status=critical AND bytes>1000

Answer

status="error" OR status="critical" bytes>1000

Question 8

An analyst wants to create a timechart of the count of events per hour, but only for events where the field `status` contains the word "fail" (case-insensitive). Which search is correct?

Accepted Answer

index=main | timechart count by eval(case(match(status,"(?i)fail"),1)). It uses `eval` with `case` and `match` to create a field that is 1 when `status` contains 'fail' (case-insensitive via `(?i)`), then uses `timechart count by` that field to count only matching events per hour. This approach correctly filters within the timechart aggregation, ensuring only events where status matches the pattern are counted.

Answer

index=main | timechart count | search status=*fail*

Answer

index=main | regex status="fail" | timechart count

Answer

index=main | where status="*fail*" | timechart count

Question 9

Which TWO of the following statements about the `transaction` command are true? (Choose two.)

Accepted Answer

The transaction command can only be used on events that have a timestamp.. True because every event in Splunk has a timestamp, and the `transaction` command relies on timestamps to group events into transactions. Option C is true because the `transaction` command can group events that share a common field value, such as a session ID, allowing correlation of related events. Option D is true because the `transaction` command adds fields like `duration` and `eventcount` to each transaction. Options B and E are false: B is false because the `transaction` command uses a fixed or pause-based window, not a sliding window; E is false because the `transaction` command does not remove all fields except those specified – it retains fields and adds new ones.

Answer

The transaction command uses a sliding time window to detect transaction boundaries.

Answer

The transaction command removes all fields except those specified in the `fields` argument.

Question 10

Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)

Accepted Answer

... | map search="search index=other $field$". The `map` command in SPL allows you to run a subsearch for each result of the outer search, using field values from the outer result (e.g., `$field$`) to dynamically construct the inner search. This is a valid way to create a subsearch that iterates over search results, making it a legitimate subsearch pattern in Splunk.

Answer

... | join type=inner [search index=other]

Answer

[return index=main | stats count]

Question 11

A security analyst wants to find all events where the field 'src_ip' matches any IP address in a lookup table named 'malicious_ips.csv'. The lookup has fields 'ip' and 'threat'. Which search correctly enriches events with the threat info and filters to only malicious IPs?

Accepted Answer

`index=security | lookup malicious_ips.csv src_ip OUTPUT threat | where threat!=""`. Both options B and E are correct. Option B uses `lookup malicious_ips.csv src_ip OUTPUT threat | where threat!=""` which effectively enriches events with the threat field and filters to only events where a match occurred. Option E uses `lookup malicious_ips.csv src_ip AS ip OUTPUTNEW threat | where isnotnull(threat)` achieving the same result with minor syntax differences. The other options fail either to enrich properly or to filter correctly: A is inefficient and may not filter reliably, C does not enrich, and D has incorrect lookup syntax.

Answer

`index=security | lookup malicious_ips.csv src_ip | search threat=*`

Answer

`index=security [| inputlookup malicious_ips.csv | fields ip | rename ip as src_ip]`

Answer

`index=security | lookup malicious_ips.csv src_ip AS ip | where isnotnull(threat)`

Question 12

A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?

Accepted Answer

`... | timechart span=1h dc(user)`. `timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.

Answer

`... | stats dc(user) by _time span=1h`

Answer

`... | timechart span=1h dc(by user)`

Answer

`... | eval user=user | timechart span=1h count by user`

Answer

`... | timechart span=1h sum(count) by user`

Question 13

A search includes `... | eval day=strftime(_time, "%A") | stats count by day | sort count`. The results show Monday has the highest count. The analyst wants to confirm that the timezone is correctly applied. Which command should be added before the eval to ensure the day calculation uses the local timezone?

Accepted Answer

`... | eval _time=_time + (your_tz_offset*3600) | eval day=strftime(_time, "%A") ...`. The `strftime` function uses the server's timezone by default, which may not match the local timezone. By manually adding the timezone offset (in seconds) to `_time` before the `eval`, you shift the epoch timestamp to reflect the local time, ensuring that `strftime` calculates the correct day of the week. This is a common workaround when the search head's timezone differs from the user's local timezone.

Answer

`... | eval day=strptime(_time, "%A") | ...`

Answer

`... | fields + _time, day | ...`

Answer

`... | convert ctime(_time) | eval day=strftime(_time, "%A") ...`

Answer

`... | eval _time=relative_time(_time, "-0@d") | eval day=strftime(_time, "%A") ...`

Question 14

Which THREE of the following commands can produce a time-based chart (timechart or chart with time buckets)? (Choose three.)

Accepted Answer

`chart count over _time bins=24`. Option A, `chart count over _time bins=24`, is correct because the `chart` command with `over _time` and `bins=24` buckets the `_time` field into 24 time intervals, producing a time-based chart. Option C, `timechart span=1h count`, is correct because `timechart` is the dedicated Splunk command for time-series charts, and `span=1h` sets one-hour time buckets. Option E, `chart count by _time span=1d`, is correct because `chart` with `by _time` and `span=1d` creates daily time buckets, yielding a time-based chart. Option B, `stats count by _time span=1h`, does not belong because `stats` produces a statistical table, not a chart, even though it can bucket by time. Option D, `top _time`, does not belong because `top` returns the most common values of a field and does not generate a time-bucketed chart.

Answer

`stats count by _time span=1h`

Answer

`top _time`

Question 15

A security analyst needs to find all events where the field 'status' is either 'error' or 'critical', and then count the number of events per source IP. Which search is correct?

Accepted Answer

index=security (status=error OR status=critical) | stats count by src_ip. Options A and C are correct because both achieve the required result: A uses the search command's boolean expression (status=error OR status=critical) with parentheses to group the OR condition before the pipe, while C uses the where command with the same OR expression after the initial search. In Splunk, the where command evaluates boolean expressions on fields, so 'where status=error OR status=critical' correctly filters events matching either value, and both then use 'stats count by src_ip' to count events per source IP. Option B is incorrect because 'status=error AND status=critical' requires a single event to have both values simultaneously, which is impossible for one status field. Option D is incorrect because without parentheses the OR is not properly grouped, causing the search to be parsed as (index=security status=error) OR (status=critical), which changes the scope and can return events outside index=security.

Answer

index=security status=error AND status=critical | stats count by src_ip

Answer

index=security status=error OR status=critical | stats count by src_ip