SPLK-1002 Advanced Searching and Statistics Practice Test 2 — 15 Questions

Question 1

A Splunk administrator runs the following search to identify the top 5 users by total bytes transferred:

index=proxy sourcetype=webproxy
| stats sum(bytes) as total_bytes by user
| sort - total_bytes
| head 5

The search returns results, but the numbers seem inflated. On closer inspection, the 'bytes' field is a string type. What must be done to correct the search?

Accepted Answer

Use 'eval bytes_numeric = tonumber(bytes)' then 'stats sum(bytes_numeric) as total_bytes by user'.. `bytes` is stored as a string. `stats sum()` may not correctly sum string values if they contain non-numeric characters. Using `eval tonumber()` creates a numeric field and safely converts non-numeric values to null (ignored by sum), ensuring accurate totals. While `convert num(bytes)` (Option A) is a valid command, `eval tonumber()` is the preferred method for explicit conversion before statistical aggregations.

Answer

Use 'convert num(bytes)' before stats.

Answer

Use 'where isnum(bytes)' to filter out non-numeric values before stats.

Answer

Use 'eval bytes = string(bytes)' before stats.

Question 2

An analyst needs to calculate the average response time for each web server, but only for requests that returned status code 200. The field 'response_time' is numeric. Which search correctly achieves this?

Accepted Answer

index=web status=200 | stats avg(response_time) by server. It first filters the data to only include events with status=200 using a search-time field filter, then uses the `stats` command with `avg(response_time) by server` to compute the average response time per server. This ensures that only successful requests are included in the aggregation, and the `by server` clause correctly groups the results by each web server.

Answer

index=web | transaction server maxspan=1m | stats avg(response_time) by server

Answer

index=web status=200 | eventstats avg(response_time) as avg_time by server

Answer

index=web | eval avg_time = avg(response_time) by server | search status=200

Question 3

A security analyst needs to find all login events where the user 'jsmith' attempted to authenticate from an IP address outside the corporate subnet (10.0.0.0/8) after business hours (after 18:00). Which search correctly filters for these events?

Accepted Answer

index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip). It uses the `cidrmatch` function to properly evaluate whether the source IP falls within the 10.0.0.0/8 subnet. The `where` clause with `date_hour > 18` correctly filters for events after business hours, and the `NOT cidrmatch` ensures only IPs outside the corporate subnet are included. This approach handles CIDR notation accurately, unlike simple string or inequality comparisons.

Answer

index=main sourcetype=login user=jsmith date_hour>18 | search NOT src_ip=10.0.0.0/8

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where not src_ip like "10.%"

Answer

index=main sourcetype=login user=jsmith date_hour>18 | where src_ip!=10.0.0.0/8

Question 4

Match each Splunk search operator to its behavior.

Accepted Answer

AND: Returns results that match both terms. The correct matches are: AND combines with both, OR with either, NOT excludes. Common confusion is swapping AND and OR.

Answer

AND: Returns results that match either term

Answer

OR: Returns results that match both terms

Question 5

Match each Splunk report type to its description.

Accepted Answer

Table Report: Displays raw or transformed data in a tabular format with rows and columns.. In Splunk, report types define how data is presented. Table Reports show raw data in rows/columns, Chart Reports use graphs, Single Value Reports show one key metric, and Statistics Reports summarize data. Common confusions arise between Table/Statistics and Chart/Single Value.

Answer

Table Report: Displays summary statistics with counts and averages.

Answer

Chart Report: Displays a single numerical value with a sparkline.

Question 6

A security analyst needs to find the top 10 users with the most failed login attempts from the linux_secure sourcetype. Which SPL command is most efficient for this task?

Accepted Answer

index=main sourcetype=linux_secure "Failed password" | top limit=10 user. The `top` command in SPL is specifically designed to return the most frequent values of a field, and the `limit=10` parameter directly restricts the output to the top 10 results. This approach is more efficient than using `stats count` followed by `sort` and `head` because `top` performs the aggregation and ranking in a single operation, reducing processing overhead. The search also correctly filters for 'Failed password' events within the `linux_secure` sourcetype, ensuring only failed login attempts are considered.

Answer

index=main sourcetype=linux_secure "Failed password" | stats count by user | sort 10 -count

Answer

index=main sourcetype=linux_secure "Failed password" | stats count by user | sort -count | head 10

Answer

index=main sourcetype=linux_secure | regex _raw="Failed password" | stats count by user | top limit=10

Question 7

A search returns 50,000 events. The analyst wants to sample 1% evenly across time. Which sampling command should be used?

Accepted Answer

sample method=random ratio=0.01. The `sample` command with `method=random` and `ratio=0.01` performs a random sampling of exactly 1% of events, and when used without a `by` clause, it distributes the sampling evenly across time by default. This ensures a statistically representative subset of the 50,000 events, preserving temporal distribution.

Answer

sample 0.01

Answer

sample method=block ratio=0.01

Answer

sample ratio=0.01

Question 8

Which of the following searches correctly computes the average response time per host?

Accepted Answer

index=main | stats mean(response_time) by host. The `stats` command with `mean(response_time)` calculates the arithmetic mean of the response_time field, and the `by host` clause groups the calculation per host, producing the average response time for each host. This is the standard Splunk syntax for computing averages in a grouped statistics table.

Answer

index=main | stats average(response_time) by host

Answer

index=main | eventstats avg(response_time) by host

Answer

index=main | stats avg response_time by host

Question 9

Which command extracts a field named 'ip' from the raw event using a regex pattern?

Accepted Answer

rex "ip=(?\d+\.\d+\.\d+\.\d+)". The `rex` command uses the named capture group syntax `(?...)` to extract a field named 'ip' from the raw event. The pattern `(?\d+\.\d+\.\d+\.\d+)` matches an IPv4 address and assigns it to the field 'ip'. By default, `rex` operates on the `_raw` field, so no explicit `field=_raw` is needed, and the syntax `(?...)` is the correct Splunk named capture group syntax.

Answer

rex "ip=(?\d+\.\d+\.\d+\.\d+)"

Answer

rex field=_raw "ip=(?P<ip>\d+\.\d+\.\d+\.\d+)"

Answer

rex field=_raw "ip=(?<ip>\d+\.\d+\.\d+\.\d+)"

Question 10

A search produces a field 'count'. You need to find the event with the maximum count. Which approach is correct?

Accepted Answer

| eventstats max(count) as maxcount | where count = maxcount. Both options A and C are valid approaches to find the event with the maximum count. Option A uses `eventstats` to compute the maximum count and adds it to each event, then filters events where the count equals the maximum. This returns all events that share the maximum count, preserving full event data. Option C sorts events in descending order by count and takes the first event with `head 1`, returning one event with the maximum count. If multiple events tie for the maximum, `head 1` returns only one, but it still correctly identifies an event with the maximum count. Option D (`stats max(count) as maxcount`) returns only the maximum value, not the event details, so it is incorrect. Option B is not a valid search command; it is a self-referential statement, and thus incorrect.

Answer

Both B and C work.

Answer

| stats max(count) as maxcount

Question 11

Which TWO of the following are valid methods to join two sets of search results?

Accepted Answer

join. In Splunk SPL, the join command (option A) is a valid method to combine two sets of search results by matching on a common field, using syntax like join [subsearch] to correlate events from the main search with those from the subsearch. The append command (option B) is also valid: it adds the results of a subsearch to the end of the current result set, effectively joining two sets of results by concatenation (e.g., append [search ...]). The union command (option C) is not one of the two marked correct answers here, and stats values(*) (option D) is an aggregation that collects distinct values per field rather than joining result sets. addcoltotals (option E) merely appends column total rows to a result table and does not combine two separate search result sets.

Answer

union

Answer

stats values(*)

Answer

addcoltotals

Question 12

Which TWO of the following eval functions can be used to convert a string to a numeric value?

Accepted Answer

int(). In Splunk's eval command, int() (option C) converts a string or number to an integer by truncating any decimal portion, and tonumber() (option E) converts a string to a numeric value, supporting optional base arguments and returning null on failure — both are valid string-to-number conversion functions. tostring() (option A) does the opposite, converting a numeric value into a string, so it cannot convert a string to a number. number() (option B) is not a valid Splunk eval function. str() (option D) is also not a valid Splunk eval function; the correct string-conversion function is tostring().

Answer

tostring()

Answer

number()

Answer

str()

Question 13

Refer to the exhibit. The search returns 50 results after the `where` command. What is the purpose of the `eval` command?

Accepted Answer

To create a new field 'severity' based on a condition.. The `eval` command in Splunk is used to create new fields or evaluate expressions. In this context, the `eval` command creates a new field called 'severity' by evaluating a conditional expression that assigns a value based on the 'count' field. This is confirmed by the search returning 50 results after the `where` command, meaning the `eval` command does not filter results but instead adds a computed field.

Answer

To filter out results with count ≤ 100.

Answer

To modify the 'count' field.

Answer

To rename the 'count' field to 'severity'.

Question 14

Refer to the exhibit. The search is intended to display users who logged in from IP addresses starting with 10.0, but returns no results. What is the most likely cause?

Accepted Answer

The `search` command should be `where` to use wildcard on extracted fields.. The search uses `search ip=10.0*` which attempts to apply a wildcard pattern to an extracted field. However, the `search` command does not support wildcards for field-value comparisons; it treats `10.0*` as a literal string. To use wildcards on extracted fields, the `where` command with a `like` operator (e.g., `where ip like "10.0%"`) or a regex match is required. This is why option C is correct.

Answer

The regex pattern is incorrect.

Answer

The field 'ip' is not extracted properly.

Answer

The index should be specified at the beginning of the search.

Question 15

An analyst wants to create a time series chart showing the count of errors per hour over the last 24 hours. The errors are logged with sourcetype=error_log. Which search achieves this?

Accepted Answer

index=main sourcetype=error_log | timechart count span=1h. `timechart count span=1h` automatically creates a time series chart with one-hour buckets over the last 24 hours, grouping events by `_time` and counting them per bucket. The `timechart` command is specifically designed for time-based aggregation and produces a chart with `_time` on the x-axis, which is exactly what the analyst needs. Options A and C incorrectly use the `chart` command which treats time as a categorical field, and Option B uses `bin` and `stats` but does not produce a time series chart directly; it only produces a table. Only `timechart` yields the desired visualization.

Answer

index=main sourcetype=error_log | chart count over _time by hour

Answer

index=main sourcetype=error_log | bin _time span=1h | stats count by _time

Answer

index=main sourcetype=error_log | chart count by _time