SPLK-1003 Advanced Searching and Statistics Practice Test 10 — 15 Questions

Question 1

A security analyst is investigating a potential breach. They have a search that uses the transaction command to group events by session_id and calculates the total bytes transferred per session. However, the search takes over 30 minutes to complete on a 24-hour time range. The environment has 10 indexers with default settings. The analyst needs to reduce search time while preserving the ability to group by session_id. Which course of action should they take?

Accepted Answer

Pre-aggregate events by session_id using 'stats values(*) as * sum(bytes) as total_bytes by session_id' before the transaction command.. Option C is correct because summarizing events by session_id using stats with values and sum before the transaction command reduces the number of events that transaction needs to process. Option A would disable parallel processing, making it slower. Option B adds subsearch overhead. Option D changes the grouping logic and does not reduce the workload.

Answer

Use an append command to add a subsearch that pre-filters events.

Answer

Replace transaction with the 'streamstats' command to compute running totals.

Answer

Add the 'local' keyword to the transaction command to force it to run on a single indexer.

Question 2

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

Accepted Answer

Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.. Option B is correct because adding a summary index that precomputes the counts by severity and using that in the dashboard reduces the real-time data scan. Option A would not help as it only benefits ad-hoc searches. Option C reduces the number of events but also changes the output (fewer severities). Option D uses streaming commands which may not reduce disk I/O significantly.

Answer

Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.

Answer

Limit the time range to the last 1 hour instead of 24 hours.

Answer

Enable search acceleration for the index.

Question 3

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

Accepted Answer

Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.. Option D is correct because using 'stats' with 'range(_time)' by session_id to compute duration is much more efficient than transaction. Option A removes the maxspan, which may cause sessions to be open-ended and consume more memory. Option B reduces the time range but does not address the inefficiency of transaction. Option C adds an eventstats that does not replace the transaction.

Answer

Reduce the time range to 1 hour.

Answer

Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

Answer

Remove the maxspan parameter from the transaction command to allow longer sessions.

Question 4

A network operations team uses Splunk to analyze firewall logs. They need to identify top talkers (source IPs with highest total bytes) over the last hour. The current search: 'index=firewall | stats sum(bytes) as totalBytes by src_ip | sort -totalBytes | head 10' takes 5 minutes to complete. They want to make it faster. The environment has 5 indexers with default configurations. The data volume is 100 GB/day. Which action will most improve search performance?

Accepted Answer

Add 'earliest=-1h' to the search to restrict the time range explicitly.. Option A is correct because explicitly adding 'earliest=-1h' restricts the search to the last hour at the search head level, allowing Splunk to use time-based index metadata to skip irrelevant buckets entirely. Without an explicit time range, Splunk may scan all available data, dramatically increasing I/O and search time. This is the most impactful optimization for time-bound searches over large datasets.

Answer

Replace head 10 with limit 10 at the end of the pipeline.

Answer

Use map to run the search per indexer.

Answer

Set the search's parallelism to 'auto' in the commands.

Question 5

A developer wants to debug a slow Splunk search that uses multiple eval and where commands. The search returns correct results but takes 2 minutes. The developer wants to identify which parts of the search are slow. The environment is a single instance Splunk with moderate data. What should the developer do?

Accepted Answer

Run the search with the 'search job inspector' option enabled.. Option C is correct because the Search Job Inspector provides detailed per-command execution statistics, including time spent, number of results, and memory usage for each pipe segment. This allows the developer to pinpoint exactly which `eval` or `where` command is causing the slowdown, without altering the search logic or time range.

Answer

Manually check the search in the Job Manager after it completes.

Answer

Limit the time range to 1 minute and run the search.

Answer

Add comments to the search to track progress.

Question 6

Which TWO commands can be used to perform statistical aggregations on streaming events without creating a separate search results set?

Accepted Answer

streamstats. C is correct because streamstats performs statistical aggregations on streaming events in real-time as they arrive, without creating a separate search results set. It computes windowed statistics (e.g., running sum, moving average) on the event stream itself, appending the result to each event. D is correct because eventstats also operates on the current event set, computing aggregations and adding the results as new fields to each event without generating a separate output set.

Answer

timechart

Answer

stats

Answer

chart

Question 7

A security team runs a search to count login failures per user over the last 24 hours: `index=security action=failure | stats count by user`. The results show counts, but some users have extremely high counts due to a brute force attack. The team wants to identify users with a count greater than 100. What should they do to get the desired list?

Accepted Answer

Add `| where count > 100` after the stats command.. Option B is correct because the `stats count by user` command creates a field called `count` that holds the number of login failures per user. Adding `| where count > 100` after the stats command filters the results to show only users whose count exceeds 100. The `where` command evaluates field values in the current results, making it the appropriate tool for this post-aggregation filter.

Answer

Use `| top limit=100 user` to get the top 100 users.

Answer

Add `| where count > 100` before the stats command.

Answer

Use `| filter count > 100` after the stats command.

Question 8

A Splunk environment ingests 10 TB per day. A user runs a search to count events per sourcetype over the last 7 days: `index=* earliest=-7d | timechart count by sourcetype`. The search returns partial results and eventually times out. The user needs to obtain the complete results efficiently. What is the best course of action?

Accepted Answer

Use `| tstats count where index=* earliest=-7d by _time span=1d, sourcetype` and then format as needed.. Option C is correct because `tstats` runs on indexed metadata (tsidx files) rather than raw events, making it far more efficient for counting events over large time ranges. By specifying `by _time span=1d, sourcetype`, you get daily counts per sourcetype without scanning the entire event data, avoiding the timeout that occurs with a raw search over 10 TB/day for 7 days.

Answer

Use `| bucket span=1d | stats count by _time sourcetype` then `| xyseries` to format.

Answer

Use `| sitime` to sample the data and approximate counts.

Answer

Break the search into 1-day intervals and use `append` to combine results.

Question 9

A user runs a search on web access logs: `index=web | eventstats sum(bytes) as total_bytes by host`. The search returns the correct total bytes per host, but now the user needs to calculate the average bytes per host for each event. Which command should be added to the base search to achieve this?

Accepted Answer

Add `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats.. eventstats can compute the average directly with `avg(bytes)`. Option A requires manually calculating average with count, which is more complex. Option C uses streamstats, which computes a running average, not overall. Option D uses stats and join, which is slower and may not work well.

Answer

Replace eventstats with `| streamstats avg(bytes) as avg_bytes by host`.

Answer

Add `| eval avg_bytes = total_bytes / count` after the eventstats.

Answer

Use `| stats avg(bytes) by host` then `| join host [search index=web]`.

Question 10

A user needs a report showing the number of distinct source IPs per sourcetype over the last hour. They run: `index=* earliest=-1h | stats dc(src_ip) by sourcetype`. The search runs slowly (2 minutes) and they want to speed it up. Which optimization is most effective?

Accepted Answer

Use `| tstats dc(src_ip) where index=* earliest=-1h by sourcetype`.. tstats on an accelerated data model is much faster than scanning raw data. Option B uses nested stats which still scans raw data. Option C does not produce the desired result. Option D gives top sourcetypes, not distinct IPs.

Answer

Use `| top limit=100 sourcetype` to get top sourcetypes.

Answer

Use `| stats count by sourcetype, src_ip | stats count by sourcetype`.

Answer

Use `| chart count over sourcetype by src_ip`.

Question 11

A security analyst wants to create a comparison report showing the count of login failures by user for today versus yesterday. They run: `index=security action=failure | timechart count by user`. This produces a chart of counts over time, but they want separate columns for today and yesterday. How can they achieve this comparison efficiently?

Accepted Answer

Use `| eval day=if(_time>=relative_time(now(),"@d"),"today","yesterday") | timechart count by user by day`.. Using `eval` to create a day label and then `timechart` with the user and day fields creates the desired side-by-side chart. Option A is incorrect because timechart does not have a 'useother' option for this. Option C works but is less efficient and may require manual time ranges. Option D does not produce a time-based comparison.

Answer

Use `| append [search index=security action=failure earliest=-2d@d latest=-1d@d | eval period="yesterday"] | timechart count by user by period`.

Answer

Use `| stats count by user _time | xyseries _time user count`.

Answer

Use `| timechart count by user useother=t` with the time range set to 'Yesterday' and 'Today' in the time picker.

Question 12

An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?

Accepted Answer

index=web status=404 | top limit=5 user_agent. Option A is correct because it first filters events to only those with status=404, then uses the `top` command with `limit=5` to efficiently count and rank user_agent values. This ensures the search only processes relevant events, minimizing resource usage and returning the correct top 5 user agents for 404 errors.

Answer

index=web | top limit=5 user_agent status=404

Answer

index=web | top limit=5 user_agent

Answer

index=web | stats count by user_agent | where status=404 | top 5 user_agent

Question 13

Which TWO of the following searches are syntactically valid uses of the eventstats command? (Assume all referenced fields exist.)

Accepted Answer

| eventstats sum(bytes) as total_bytes by src_ip | eval pct = bytes/total_bytes*100. Option B is correct because the `eventstats` command calculates aggregate statistics (here, `sum(bytes)`) over the entire result set or by group (here, `by src_ip`), and it adds the result as a new field (`total_bytes`) to every event. This allows the subsequent `eval` to compute a per-event percentage using that new field. Option C is correct because `eventstats` without a `by` clause computes the aggregate over all events and adds the result (here, `avg`) to each event, enabling the `eval` to calculate the difference from the global average.

Answer

| eventstats perc95(response_time) by host | eval p95 = perc95

Answer

| eventstats values(user) as users by session_id | eval num_users = len(users)

Answer

| eventstats max(_time)last_time by user | table last_time

Question 14

Refer to the exhibit. What does the pct field represent?

Accepted Answer

The percentage of each status within each one-hour time bucket.. The `pct` field in the context of a time-based chart (e.g., `timechart count by status`) represents the percentage of each status value within each one-hour time bucket. This is calculated by dividing the count of a specific status in that bucket by the total count of all statuses in the same bucket, then multiplying by 100. Option C correctly identifies this per-bucket proportional breakdown.

Answer

The running total percentage of events over time.

Answer

The percentage of each status across the entire time range.

Answer

The percentage of events for that status compared to the maximum count in that hour.

Question 15

A large e-commerce company uses Splunk to monitor their web application. They have a query that uses the transaction command to group related events into transactions based on session ID and a 30-minute max pause. The query runs slowly and often times out. The environment has 10 indexers with 4 CPU cores each. The search is run over the last 7 days. Which of the following is the best course of action to improve performance?

Accepted Answer

Replace the transaction command with a combination of stats and streamstats commands.. The `transaction` command is resource-intensive because it groups events by a field (session ID) and a max pause, requiring significant memory and processing to correlate events across the entire search time range. Replacing it with `stats` and `streamstats` is more efficient because `stats` can aggregate events by session ID without the overhead of transaction boundaries, and `streamstats` can compute running totals or windows within each session, leveraging distributed processing across indexers. This approach reduces memory pressure and avoids the timeout issue by using streaming operations that scale better with large datasets.

Answer

Use the eval command to create a transaction ID field and then use stats to group events.

Answer

Reduce the max pause to 15 minutes to limit the number of events in each transaction.

Answer

Increase the number of indexers to 20 to distribute the load.