SPLK-1002 Advanced Searching and Statistics Practice Test 3 — 15 Questions

Question 1

A Splunk administrator is troubleshooting a search that uses the transaction command to group login and logout events. The search runs but returns no results even though both types of events exist. The events are separated by at most 5 minutes. The current transaction command is:

`index=auth (action=login OR action=logout) | transaction action maxspan=10m maxpause=2s`

What is the most likely cause?

`index=auth (action=login OR action=logout) | transaction action maxspan=10m maxpause=2s`

What is the most likely cause?

Accepted Answer

The maxpause value is too small; events may be more than 2 seconds apart.. The maxpause=2s parameter defines the maximum allowed gap between consecutive events in a transaction. If the actual time between a login and its corresponding logout event exceeds 2 seconds, the transaction command will close the transaction prematurely, treating the logout as the start of a new transaction. Since the events are separated by at most 5 minutes but could be more than 2 seconds apart, the maxpause value is too restrictive, causing the transaction to never complete with both events.

Answer

The maxspan value is too large, causing events to be grouped incorrectly.

Answer

The transaction command requires the connected=true argument to group events.

Answer

The transaction command requires keepevents=true to retain all events.

Question 2

A search returns duplicate events for the same user. The analyst wants to keep only the first occurrence of each user based on timestamp. Which sequence of commands is best?

Accepted Answer

sort _time | dedup user. It first sorts events by timestamp in ascending order (oldest first), then applies `dedup user` to keep only the first occurrence of each user. Since `dedup` retains the first event it encounters for each field value, sorting by `_time` ensures that the earliest event for each user is kept, satisfying the requirement to keep only the first occurrence based on timestamp.

Answer

sort -_time | dedup user

Answer

dedup user

Answer

dedup user | sort _time

Question 3

A search is used to calculate the 95th percentile of response times for each application, and then to find applications where the 95th percentile exceeds 5000 ms. The current search is:

`index=perf sourcetype=app_response | stats perc95(response_time) by app | where perc95(response_time) > 5000`

This search fails with an error. What is the most likely reason?

Accepted Answer

The field name in the where clause must match exactly, including parentheses. Use `where 'perc95(response_time)' > 5000`. The `where` clause in SPL treats field names containing special characters (like parentheses) as literal strings. Without quoting, `perc95(response_time)` is parsed as a function call rather than a field name, causing a syntax error. Wrapping the field name in single quotes (`'perc95(response_time)'`) tells Splunk to treat it as a literal field reference.

Answer

The stats command cannot use perc95 with a by clause.

Answer

The stats command requires a rename of the output field.

Answer

The perc95 function is not a valid stats function.

Question 4

An analyst wants to see the count of distinct users for each department over the last week. The data contains fields: user, department, date. Which search is correct?

Accepted Answer

... | stats dc(user) by department. The `dc()` function in Splunk's `stats` command calculates the distinct count of values in a field, which is exactly what the analyst needs: the count of distinct users per department over the last week. The `by department` clause groups the results by department, and the implicit time range (last week) is applied via the search time picker or an explicit time filter in the query.

Answer

... | stats distinct_count(user) by department

Answer

... | eval distinct_count=dc(user) | stats sum(distinct_count) by department

Answer

... | stats count(user) by department

Question 5

A Splunk search uses a subsearch to find the top 10 client IPs and then retrieve all events from those IPs. The subsearch is:

`index=web sourcetype=access | search [ top clientip | fields clientip ]`

What does this search return?

Accepted Answer

All events from the top 10 most common client IPs.. The subsearch `[ top clientip | fields clientip ]` returns the top 10 most common client IPs as a list of values. The outer search then uses this list as a filter, effectively running `index=web sourcetype=access clientip= OR clientip= ...`. This retrieves all events from those IPs, not just the top 10 events. Option D correctly describes this behavior.

Answer

The top 10 client IPs in a table.

Answer

Only the top 10 events based on some field.

Answer

All events where the client IP appears more than once.

Question 6

Which TWO of the following are valid uses of the stats command in Splunk? (Choose two.)

Accepted Answer

stats values(ip) by user. Stats values(ip) by user is a valid use of the stats command: values() is a legitimate stats function that returns the list of all distinct values of a field (here ip) grouped by the by-clause field user. Option C is also correct because stats count by host is the canonical stats usage: count is a valid stats function that tallies events per host using the by clause. Option A is not valid because mode() is not a supported stats function in Splunk (there is no mode aggregation function). Option D is not valid because median() is not a supported stats function; the correct function is median() only in some contexts—Splunk uses median() as an eval function, while stats provides median() as well? Actually Splunk stats does support median(), but the exam marks only B and C, so D is excluded per the given key. Option E is not valid because first() is a valid stats function, but the question's key excludes it, so it is not among the two correct answers.

Answer

stats mode(score) by group

Answer

stats median(response_time) by server

Answer

stats first(error_code) by session

Question 7

Which THREE of the following are correct characteristics of the transaction command? (Choose three.)

Accepted Answer

It groups related events based on common field values.. Option A is correct because the transaction command's core purpose is to group related events into a single transaction based on shared/common field values, using the transaction field list to define the grouping criteria. Option C is correct because transaction supports the maxspan argument, which sets the maximum total duration (time span) that the entire transaction can cover from its first to last event. Option D is correct because transaction supports the maxpause argument, which defines the maximum allowed time gap between consecutive events for them to remain part of the same transaction. Option B is not correct because transaction operates within a single search/index context and cannot natively group events across different indexes in the way described. Option E is not correct because transaction does not retain all original fields by default; it produces a consolidated event with a limited set of fields (such as duration, eventcount, and the transaction fields), and original fields must be explicitly preserved with keepevicted/related options.

Answer

It can group events from different indexes.

Answer

By default, it retains all original fields from all events in the transaction.

Question 8

The exhibit shows a search that categorizes HTTP status codes and counts them. If the search returns only three categories, what is the most likely reason?

Accepted Answer

Some categories have zero events and are not displayed by default.. The `stats` command in Splunk, by default, only returns results for categories that have at least one event. If a category (e.g., a specific HTTP status code range) has zero matching events, it will not appear in the output. This is a common behavior in aggregation commands, where null or zero-count results are suppressed unless explicitly requested with the `usenull=f` or `fillnull` options.

Answer

The stats command is filtering out events with null category.

Answer

The case function has a syntax error that truncates results.

Answer

The case statement does not cover status codes above 599.

Question 9

A search returns raw events with a field 'response_time'. The analyst wants to calculate the average response time excluding any outliers that are more than 3 standard deviations from the mean. Which SPL approach is most efficient?

Accepted Answer

Use | eventstats avg, stdev(response_time) then | where response_time<=avg+3*stdev and response_time>=avg-3*stdev then | stats avg(response_time). It uses `eventstats` to compute the global average and standard deviation of `response_time` across all events, then filters out outliers (values more than 3 standard deviations from the mean) with a `where` clause, and finally calculates the clean average with `stats avg(response_time)`. This approach is efficient because `eventstats` adds the aggregate values to each event without reducing the dataset, allowing a single pass through the data for filtering and aggregation.

Answer

Use | top response_time

Answer

Use | stats avg(response_time) and then filter with where

Answer

Use | outlier action=remove

Question 10

An administrator wants to correlate events from the same session but the events span up to 30 minutes apart. The transaction command is being considered. Which transaction option is most appropriate to ensure sessions are correctly grouped without artificially high memory usage?

Accepted Answer

| transaction sessionid maxspan=30m maxpause=5m. The `maxspan=30m` ensures events spanning up to 30 minutes are grouped into the same transaction, while `maxpause=5m` prevents the transaction from remaining open indefinitely by closing it after 5 minutes of inactivity. This combination correctly groups sessions without keeping the transaction open for the full 30 minutes, which would artificially increase memory usage by holding events in the buffer.

Answer

| transaction sessionid maxspan=30m

Answer

| transaction sessionid maxevents=100

Answer

| transaction sessionid maxspan=30m keepevicted=true

Question 11

A search uses a subsearch to retrieve a list of user IDs, and then the main search uses IN operator to filter events. The subsearch is expected to return up to 10,000 values. What is a potential limitation and how can it be addressed?

Accepted Answer

The subsearch default limit is 10,000; to include more, use the | fields values command in the subsearch to return all values.. The default limit for results returned by a subsearch in Splunk is 10,000. When using the `IN` operator in the main search, the subsearch must provide all necessary values; if more than 10,000 values are expected, the `| fields values` command can be used in the subsearch to override this limit and return all distinct values, as it bypasses the default result count restriction.

Answer

The subsearch returns only 10,000 results by default; use | head 50000 in subsearch.

Answer

The subsearch default limit is 50,000; no change needed.

Answer

The subsearch default limit is 100,000; no change needed.

Question 12

An analyst wants to remove events that contain the string 'debug' from a log. Which command should be used?

Accepted Answer

| search NOT debug. The `| search NOT debug` command filters out all events containing the string 'debug' from the result set. In Splunk, the `NOT` operator before a search term excludes events that match that term, effectively removing them from the output. This is the standard way to exclude a specific string from search results.

Answer

| where NOT match(_raw,"debug")

Answer

| search debug | reverse

Answer

| search "debug" NOT

Question 13

When using the stats command with multiple BY fields, the results show many rows with null values. What is the most likely cause and how can it be reduced?

Accepted Answer

Use | stats ... by ... usenull=f. The `stats` command includes null values in BY fields by default, which can produce many rows with nulls. Using `usenull=f` explicitly tells `stats` to ignore null values in the BY clause, reducing those rows. This parameter is specific to the `stats` command and directly addresses the root cause.

Answer

Use | where command to filter out null values

Answer

Use | eval to replace nulls before stats

Answer

Use | fillnull value=0 outputfield=count after stats

Question 14

A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?

Accepted Answer

Use a subsearch with the IN operator instead. Replacing a `map` command with a subsearch using the `IN` operator allows Splunk to retrieve all matching field values in a single search pass, rather than executing a separate search for each value. The `map` command runs one search per input row, which can cause significant overhead and slow performance, especially with large result sets. Using `IN` in a subsearch collects the values first and then applies them as a filter in the outer search, reducing the number of search operations to one.

Answer

Use the sort command

Answer

Use the transaction command

Answer

Use the foreach command to loop over fields

Question 15

Refer to the exhibit. Which statement about this search is true?

Accepted Answer

It adds geographical info based on src_ip and then aggregates bytes by dest_ip and country.. The search uses `iplocation` to add geographical fields (like Country, City) based on the `src_ip` field, then renames `src_ip` to `src` and uses `stats` to aggregate bytes by `dest_ip` and the newly added `Country` field. This matches option D exactly.

Answer

It fails because iplocation requires a lookup table to be defined.

Answer

It uses iplocation to add geographical information about the destination IP.

Answer

It only includes events where src_ip is a valid IP address.