SPLK-1002 Advanced Searching and Statistics Practice Test 10 — 15 Questions

Question 1

A search is producing results that include both internal and external traffic. The analyst wants to approximate the number of distinct destination IPs for internal traffic only, where internal IPs fall within the 10.0.0.0/8 range. Which approach is most efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use | where cidrmatch("10.0.0.0/8", src_ip) | stats dc(dest_ip). It uses `where cidrmatch("10.0.0.0/8", src_ip)` to efficiently filter events to only those with source IPs in the 10.0.0.0/8 range before passing them to `stats dc(dest_ip)`. This approach leverages Splunk's built-in CIDR matching function, which performs a bitwise comparison on the IP address, and applies the filter early in the pipeline, reducing the dataset for the distinct count operation. It is the most efficient as it avoids unnecessary evaluations or string operations on non-matching events.

Answer

Use | search src_ip=10.* | stats dc(dest_ip)

Answer

Use | rex field=src_ip to extract first octet and then filter

Answer

Use | eval internal=if(cidrmatch("10.0.0.0/8", src_ip),1,0) | stats dc(dest_ip) by internal

Question 2

Refer to the exhibit. What is the purpose of the eval command in this search?

Accepted Answer

It creates a new field 'status_category' based on the numeric status code, grouping into three categories.. The eval command creates a new field 'status_category' by evaluating a CASE expression that maps numeric HTTP status codes (e.g., 200, 404, 500) into three descriptive categories: 'OK', 'Client Error', and 'Server Error'. This is a common pattern for enriching raw data with human-readable labels without altering the original 'status' field. The correct answer is D because the search explicitly defines the new field based on the status code values.

Answer

It replaces the status field with the category.

Answer

It adds a temporary field that is not retained after stats.

Answer

It converts the status field to a string.

Question 3

A search is running slowly due to a large data volume. Which TWO modifications are likely to improve search performance? (Select two.)

Accepted Answer

Reduce the time range of the search.. Option C is correct because reducing the time range limits the volume of events the search must scan, which directly decreases the amount of data processed and speeds up the search. Option E is correct because indexed fields are extracted at index time and stored in the index, so filtering on them avoids the costly search-time field extraction and lets the search engine use the index to retrieve matching events faster. Options A, B, and D do not belong: leading wildcards (A) prevent efficient index usage and force a full scan, making searches slower; the transaction command (B) groups related events and is resource-intensive, typically degrading performance on large datasets; and dedup (D) removes duplicates but adds processing overhead, so using it early does not improve search speed.

Answer

Use wildcard characters at the beginning of search terms.

Answer

Use the transaction command to group events.

Answer

Use the dedup command as early as possible.

Question 4

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Accepted Answer

timechart. Option B, timechart, is correct because it produces a time-series visualization by bucketing events into time intervals (e.g., span=1d) and plotting aggregated values such as count or avg per bucket, which is exactly the time-series foundation needed for a week-over-week comparison. Option D, timewrap, is correct because it takes the output of a timechart and overlays or wraps multiple time periods (e.g., a 1-week span) so the current week and previous week can be compared side by side on the same chart. Used together, timechart builds the per-interval series and timewrap aligns the current and prior week for direct visual comparison. Option A, stats, is not correct here because it aggregates without producing a time-bucketed series, so it cannot by itself render a week-over-week time-series comparison. Option C, eventstats, is not correct because it adds aggregate values back to individual events rather than creating a time-series chart. Option E, appendcols, is not correct because it merely appends columns from a subsearch to the current results and does not perform time-period wrapping or time-series comparison.

Answer

stats

Answer

eventstats

Answer

appendcols

Question 5

Which THREE of the following are valid uses of the stats command? (Select three.)

Accepted Answer

Calculating the average of a field across all events.. Option A is correct because stats avg(field) computes the arithmetic mean of a numeric field across all events in the result set, which is a core aggregation function of the stats command. Option B is correct because stats min(timestamp) (or earliest()) returns the earliest timestamp value, and when combined with a by clause it produces the earliest timestamp per category. Option C is correct because stats count() by category_field groups events by the categorical field and counts events in each group, the canonical grouping use of stats. Option D is not a valid stats use because time-based charts with multiple series are produced by the timechart command, not stats. Option E is not a valid stats use because enriching events with external lookup fields is done by the lookup command, not stats.

Answer

Creating a time-based chart with multiple series.

Answer

Enriching events with fields from an external lookup.

Question 6

A team uses a large index with many sourcetypes. They want to identify categories of events that have at least 100 occurrences, compute the average response_time per category, and return the top 5 categories with the highest average response_time. Which search best optimizes performance?

Accepted Answer

index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5. It uses a single stats command to compute both avg(response_time) and count (cnt) by category, then filters, sorts, and limits the results efficiently. Option A uses eventstats followed by stats—this is less efficient and the avg field is lost after stats count, making the sort invalid. Option B uses the top command, which does not compute the correct average and may not properly enforce the count threshold across all categories. Option C computes avg by category but omits the count, so the where cnt>=100 condition will fail.

Answer

Answer

index=main | top category | eval avg=avg(response_time) | where count>=100

Answer

index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

Question 7

Which TWO search commands can be used to calculate a running total (cumulative sum) of a field over time?

Accepted Answer

accum. Option B, accum, is correct because it computes a running (cumulative) total of a numeric field across events in the order they are processed, adding each event's value to the sum of all preceding events. Option D, streamstats, is correct because it calculates cumulative statistics such as sum() over a streaming window, and with sum(field) it produces a running total across events in order. Option A, delta, is incorrect because it computes the difference between consecutive field values, not a cumulative sum. Option C, transaction, is incorrect because it groups related events into transactions based on fields or time, not a running total. Option E, eventstats, is incorrect because it adds aggregate statistics (like an overall sum) to every event rather than a cumulative running total.

Answer

delta

Answer

transaction

Answer

eventstats

Question 8

Refer to the exhibit. What will this search return?

Accepted Answer

A time-based chart with a line for each host showing count of 404 events per time period.. The search uses `timechart` with `by host`, which produces a time-based chart where each host is a separate series (line) showing the count of events where `status=404` over each time bucket. The `count` function aggregates the number of 404 events per time period, and the `by host` clause splits the results into separate lines per host. Option B correctly describes this output.

Answer

A list of events with status 404.

Answer

A table with columns for each host and a row for each time bucket showing count of 404 errors.

Answer

A bar chart of total 404 errors per host.

Question 9

A user wants to see the top 5 most common HTTP methods (field "method") from web access logs, along with their percentage of total. Which search is best?

Accepted Answer

index=web | top method limit=5 showperc=t. `top` with `limit=5` returns the five most common values of the `method` field, and `showperc=t` automatically calculates and displays each value's percentage of the total events. This directly meets the requirement to see the top 5 HTTP methods and their percentages without needing additional commands.

Answer

index=web | top method countfield=percent

Answer

index=web | eventstats count | top method

Answer

index=web | stats count by method | sort - count | head 5

Question 10

A user wants to create a timechart showing the number of distinct users per hour over the past week. Which search is correct?

Accepted Answer

index=web | timechart dc(user) span=1h. The `timechart` command automatically creates a time-based chart with a default or specified `span`, and `dc(user)` calculates the distinct count of users per time bucket. The `span=1h` argument sets the bucket size to one hour, and the `by` clause is not needed because `timechart` implicitly groups by `_time`. This produces the desired output of distinct users per hour over the past week.

Answer

index=web | bucket _time span=1h | stats dc(user) by _time

Answer

index=web | timechart dc(user) by _time span=1h

Answer

index=web | timechart count by user span=1h

Question 11

A search uses the transaction command with maxevents=1000 and maxspan=1h. The search is slow and memory-intensive. Which modification can reduce resource usage while still grouping related events?

Accepted Answer

Reduce maxevents to 100.. Reducing maxevents to 100 limits the number of events that the transaction command groups into a single transaction, which directly reduces memory consumption and processing overhead. This modification still allows related events to be grouped together, but with a smaller batch size, making the search less resource-intensive while preserving the core grouping logic.

Answer

Use eventstats with a time window.

Answer

Use tstats instead of transaction.

Answer

Increase maxspan to 2h.

Question 12

A security analyst runs `index=network sourcetype=firewall | stats count by src_ip | sort - count | head 10` to find the top 10 source IPs by event count. The search returns only 5 results. Which of the following is the most likely reason?

Accepted Answer

There are fewer than 10 unique source IPs in the results.. The `stats count by src_ip` command groups events by each unique source IP address and counts them. If the search returns only 5 results, it means there are only 5 unique source IPs in the dataset matching the time range and filters. The `head 10` command then limits output to 10 rows, but since only 5 groups exist, only 5 rows are returned.

Answer

The search time range is too short, so only a few events are counted.

Answer

The sort command should be `sort - count` without space.

Answer

The stats command should include a by clause with count in the field list.

Question 13

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

Accepted Answer

`index=main | stats perc95(response_time) by service`. `stats perc95(response_time) by service` directly calculates the 95th percentile for each service across all events in one efficient pass. It is the simplest and most efficient way. Option C, while producing the same result, is less efficient because it first appends the percentile to every event using `eventstats` and then collapses with `stats values()`, adding unnecessary overhead. Option B uses time-based bucketing and option D uses a running calculation, both of which do not produce the desired overall percentile.

Answer

`index=main | timechart perc95(response_time) by service`

Answer

`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`

Answer

`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

Question 14

A user wants to add a field showing the average value of a numeric field `latency` for each host, without reducing the number of events. Which command should be used?

Accepted Answer

eventstats. The `eventstats` command is correct because it calculates aggregate statistics (like average) over a field and appends the result as a new field to every event, preserving the original event count. Unlike `stats`, which reduces the dataset to one row per group, `eventstats` enriches each event with the computed value without removing any events.

Answer

eval

Answer

stats

Answer

streamstats

Question 15

Refer to the exhibit. The search above returns no results for api_version. What is the most likely cause?

Accepted Answer

The field `uri_path` does not exist or contains data that does not match the pattern.. The `rex` command extracts fields based on a regex pattern applied to a specific source field. If `uri_path` does not exist in the events or its values do not match the pattern `(?<api_version>/v[0-9]+)`, then no `api_version` field will be created. This is the most likely cause because the search returns no results for `api_version`, indicating the extraction failed at the source field level.

Answer

The stats command cannot be used after rex.

Answer

The search time range is too short to include any events.

Answer

The regex pattern is incorrectly written.