SPLK-1002 Advanced Searching and Statistics Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. The search results show a large number of hosts, but the `limit=5` only shows the top 5. The eval statement fails with an error. Why?

Accepted Answer

The field names created by timechart are based on the host names, not `count_1`, etc.. The `timechart` command in Splunk dynamically creates field names based on the values of the split-by field (in this case, `host`). When you use `timechart count by host limit=5`, the resulting fields are named after the actual host names (e.g., `host1`, `host2`), not generic names like `count_1`. The subsequent `eval` statement fails because it references `count_1`, which does not exist as a field in the results.

Answer

The timechart span should be smaller to avoid too many fields.

Answer

Eval cannot be used after timechart.

Answer

The eval statement must use aggregation functions.

Question 2

Refer to the exhibit. The search returns results quickly but shows zero events for some src values. What does `summariesonly=t` imply?

Accepted Answer

It restricts tstats to only use data from accelerated data model summaries.. `summariesonly=t` in a `tstats` command restricts the search to only use data from accelerated data model summaries, ignoring raw event data. This is why the search returns quickly but shows zero events for some `src` values—those values are not present in the accelerated summaries, so they are excluded from the results.

Answer

It causes tstats to search the index directly.

Answer

It makes the search run faster but less accurate.

Answer

It forces tstats to return all events, including those not in summaries.

Question 3

A company uses a large Splunk environment with many users creating dashboards. They notice that some searches are slow and consume excessive resources. What is the best practice to optimize search performance?

Accepted Answer

Use the tstats command with summariesonly=t. The `tstats` command with `summariesonly=t` is the best practice because it queries accelerated data models or summary indices rather than raw event data, drastically reducing the amount of data scanned. This command leverages pre-computed statistics, which is the most efficient way to perform searches over large datasets, especially when users are building dashboards that run repeatedly.

Answer

Use the search command with a large time range

Answer

Use the eval command to create new fields

Answer

Use the stats command with by clause on high cardinality fields

Question 4

A security analyst wants to find IP addresses that have been involved in both login failures and successful logins within a 5-minute window. Which approach is most efficient?

Accepted Answer

Using the transaction command. The transaction command groups related events that share a common field value (such as src_ip) into a single transaction, and its maxspan=5m option enforces the 5-minute window. This lets the analyst correlate failed and successful logins from the same IP within the window in a single search, which is exactly the correlation pattern transaction is designed for.

Answer

Using the appendcols command

Answer

Using a subsearch

Answer

Using the stats command with values

Question 5

Which command creates a new field that contains the string 'high' if a numeric field exceeds 100, otherwise 'low'?

Accepted Answer

eval status=if(value>100,"high","low"). The `eval` command with the `if` function correctly checks if the numeric field `value` exceeds 100 and returns the string 'high' or 'low'. In Splunk's `eval`, the `if` function requires the true and false results to be quoted strings when they are literal text, as shown in option A.

Answer

eval status=case(value>100,"high",true(),"low")

Answer

eval status=if(value>100,high,low)

Answer

None of the above

Question 6

Refer to the exhibit. This search returns an error. What is the most likely cause?

Accepted Answer

The timechart command requires a _time field which is not present after stats. The error occurs because the `stats` command removes the `_time` field from the events, and `timechart` requires a valid `_time` field to create time-based buckets. Without `_time`, `timechart` cannot generate the time axis, resulting in a search error. This is a common pitfall when chaining `stats` before `timechart` without preserving the time field.

Answer

The eval command cannot be used before timechart

Answer

The status_group field is not available after timechart because it was created in eval

Answer

The stats command aggregates data, so timechart cannot use the aggregated count field

Question 7

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Accepted Answer

index=web | where response_time < 10000 | stats avg(response_time) by user. It first filters out outliers (response_time < 10000) using the where command, then calculates the average response time per user with stats avg(response_time) by user. This ensures outliers are excluded before the average is computed. Option A is incorrect because it uses if() after stats, which incorrectly modifies the average after it includes outliers. Option B is incorrect because the where clause after stats erroneously filters based on the per-user average itself, not on individual response_time values. Option C is incorrect because eventstats computes an overall average that still includes outliers, and the subsequent filter does not retroactively affect that average.

Answer

index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

Answer

index=web | stats avg(response_time) by user | where response_time < 10000

Answer

index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

Question 8

Which THREE of the following are valid ways to count the number of events per minute for a given sourcetype?

Accepted Answer

index=main sourcetype=web | eval minute = strftime(_time, "%Y-%m-%d %H:%M") | stats count by minute. Option C is correct because it uses eval with strftime to convert _time into a minute-level string ("%Y-%m-%d %H:%M") and then stats count by minute, which directly yields the number of events per minute. Option D is correct because bucket _time span=1m rounds each event's timestamp down to a 1-minute bucket, and stats count by _time then counts events per minute bucket. Option E is correct because timechart count span=1m is the canonical Splunk command for producing a time-series count of events at 1-minute intervals. Option A is not valid because date_minute extracts only the minute-of-hour value (0-59), so events from different hours or days with the same minute number would be merged, not counted per actual minute. Option B is not valid because streamstats count window=1m maintains a running count over a 1-minute window per event rather than producing a per-minute event count, and the where count>0 filter does not aggregate events into minute buckets.

Answer

index=main sourcetype=web | stats count by date_minute

Answer

index=main sourcetype=web | streamstats count window=1m | where count>0

Question 9

A Splunk admin is responsible for a search dashboard that displays real-time statistics of application errors. The search uses 'index=app sourcetype=error | timechart count by severity span=5m'. Users report that the dashboard is slow and often times out. The environment has 4 indexers and the data volume is about 500 GB/day. The admin wants to improve performance without changing the dashboard's output. Which step should they take?

Accepted Answer

Create a summary index that runs every 5 minutes to pre-aggregate error counts by severity, and modify the dashboard to search the summary index.. Summary indexing pre-aggregates the error counts by severity every 5 minutes, so the dashboard queries a small summary index instead of scanning 500 GB/day of raw data. This preserves the exact output (counts by severity over 5-minute spans) while drastically reducing search load, making it the standard Splunk performance-tuning pattern for repetitive dashboard searches.

Answer

Replace timechart with 'bucket _time span=5m | stats count by _time, severity' and add streaming commands.

Answer

Limit the time range to the last 1 hour instead of 24 hours.

Answer

Enable search acceleration for the index.

Question 10

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

Accepted Answer

Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.. The transaction command is memory- and CPU-intensive because it groups raw events into sessions and must hold them in memory, which is why it dominates runtime on 2 TB/day across 20 indexers. Replacing it with stats earliest(_time) and latest(_time) by session_id computes the same duration using the streaming stats command, which is far more efficient and parallelizable. This preserves the average session duration calculation while eliminating the transaction bottleneck.

Answer

Reduce the time range to 1 hour.

Answer

Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

Answer

Remove the maxspan parameter from the transaction command to allow longer sessions.

Question 11

A security team runs a search to count login failures per user over the last 24 hours: `index=security action=failure | stats count by user`. The results show counts, but some users have extremely high counts due to a brute force attack. The team wants to identify users with a count greater than 100. What should they do to get the desired list?

Accepted Answer

Add `| where count > 100` after the stats command.. The `stats count by user` command creates a field called `count` that holds the number of login failures per user. Adding `| where count > 100` after the stats command filters the results to show only users whose count exceeds 100. The `where` command evaluates field values in the current results, making it the appropriate tool for this post-aggregation filter.

Answer

Use `| top limit=100 user` to get the top 100 users.

Answer

Add `| where count > 100` before the stats command.

Answer

Use `| filter count > 100` after the stats command.

Question 12

A user runs a search on web access logs: `index=web | eventstats sum(bytes) as total_bytes by host`. The search returns the correct total bytes per host, but now the user needs to calculate the average bytes per host for each event. Which command should be added to the base search to achieve this?

Accepted Answer

Add `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats.. Adding `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats computes the average bytes per host for each event, preserving all raw events. Option B is incorrect because streamstats would compute a running (cumulative) average, not the overall average per host. Option C is incorrect because it attempts `eval avg_bytes = total_bytes / count`, but `count` is not a field available in each event; moreover, it would require a per-host count, which is not directly available without another aggregation. Option D is inefficient and unnecessary, as `stats` would aggregate away the events, and `join` is slow and can cause issues with large datasets.

Answer

Replace eventstats with `| streamstats avg(bytes) as avg_bytes by host`.

Answer

Add `| eval avg_bytes = total_bytes / count` after the eventstats.

Answer

Use `| stats avg(bytes) by host` then `| join host [search index=web]`.

Question 13

An analyst wants to identify the top 5 user agents that generated the most 404 errors in the last 24 hours. Which search accomplishes this correctly and efficiently?

Accepted Answer

index=web status=404 | top limit=5 user_agent. It first filters events to only those with status=404, then uses the `top` command with `limit=5` to efficiently count and rank user_agent values. This ensures the search only processes relevant events, minimizing resource usage and returning the correct top 5 user agents for 404 errors.

Answer

index=web | top limit=5 user_agent status=404

Answer

index=web | top limit=5 user_agent

Answer

index=web | stats count by user_agent | where status=404 | top 5 user_agent

Question 14

An analyst needs to enrich each event with the previous event's status code for the same user session, assuming events are already sorted by time. The session ID field is `session_id` and the status field is `status`. Which SPL search accomplishes this?

Accepted Answer

index=web | sort 0 + _time | streamstats current=f global=f last(status) AS prev_status BY session_id. To get the previous event's field value within a session, you need a streaming command that can look back at prior events. streamstats with current=f excludes the current event, and global=f ensures the calculation resets for each session_id, so last(status) yields the prior status. Sorting by time ensures correct order.

Answer

index=web | sort 0 + _time | streamstats current=t global=t last(status) AS prev_status BY session_id

Answer

index=web | sort 0 + _time | eventstats last(status) AS prev_status BY session_id

Answer

index=web | sort 0 + _time | delta status AS prev_status BY session_id

Question 15

A security analyst runs the following search across a 24-hour window:

index=firewall action=blocked
| stats count by src_ip
| sort - count
| head 10

The job completes but returns a single row where src_ip is NULL and count is 48213. The analyst expected ten distinct blocked source addresses. Which explanation best accounts for the single NULL row?

Accepted Answer

The src_ip field is not extracted at search time because no field extraction is defined for the firewall sourcetype, so every event falls into a single bucket whose key is NULL.. The stats command groups events by the BY clause value, and events lacking that field are aggregated into one group whose key is null rather than being excluded. A firewall sourcetype with no defined src_ip extraction therefore yields one NULL row summing every blocked event. Verifying the extraction with a raw event or field summary confirms the diagnosis before rebuilding the search.

Answer

The stats command silently drops events whose BY field is null unless the fillnull command is applied beforehand.

Answer

The sort command cannot order results when a field contains null values, so it collapsed all groups into one row.

Answer

The head command is discarding the first nine groups and displaying only the residual NULL bucket that sort placed last.