SPLK-1002 Advanced Searching and Statistics Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. What does the final result represent?

Accepted Answer

Hours where any user's logon count is more than double the average for that hour.. The `eventstats` command calculates a per-hour average logon count across all users. The `where` clause then filters for events where a specific user's logon count for that hour is more than double that hourly average. This directly matches option C: hours where any user's logon count exceeds twice the average for that hour.

Answer

Users who log on more than twice on average.

Answer

Hours where the total logon count is more than double the average.

Answer

Users who have a logon count greater than twice their personal average.

Question 2

A security analyst wants to find IP addresses that have attempted to access a specific URL more than 5 times in the last hour and also have a user agent string containing "curl". They need to use a subsearch to pre-filter IPs. Which search is correct?

Accepted Answer

index=web sourcetype=access [search useragent=*curl* | stats count by src_ip | where count>5 | fields src_ip] | stats count by src_ip | where count>5. It uses a subsearch to first find IPs that have accessed the URL more than 5 times with a user agent containing 'curl', then passes those IPs to the outer search to filter the original data. The subsearch returns a list of src_ip values, which the outer search uses as a filter, ensuring only IPs meeting both conditions are counted again. This matches the requirement to pre-filter IPs using a subsearch.

Answer

[search index=web sourcetype=access useragent=*curl* | stats count by src_ip | where count>5] | fields src_ip

Answer

index=web sourcetype=access | search useragent=*curl* | stats count by src_ip | where count>5

Answer

index=web sourcetype=access ( useragent=*curl* ) | stats count by src_ip | where count>5

Question 3

A user wants to create a chart showing the count of errors per hour for the last 24 hours, with time bucketed hourly. Which search is correct?

Accepted Answer

index=main error | timechart count span=1h. The `timechart` command automatically creates a time-based chart with a default count aggregation. The `span=1h` argument explicitly sets the bucket size to one hour, which groups events into hourly intervals over the last 24 hours. This produces the exact output the user needs: a count of errors per hour.

Answer

index=main error | bucket _time span=1h | stats count by _time

Answer

index=main error | chart count by _time span=1h

Answer

index=main error | timechart count by _time span=1h

Question 4

Which TWO of the following commands can be used to create a table of unique values for a field, along with their counts?

Accepted Answer

stats count by field_name. Option A, `stats count by field_name`, is correct because the `stats` command with `count by` groups events by each distinct value of the specified field and returns a row per unique value with its count, producing exactly a table of unique values and their counts. Option D, `top field_name`, is correct because the `top` command returns the most common values of a field along with their frequency counts, effectively creating a table of unique values and counts (ordered by frequency). Option B, `fields field_name`, only includes or excludes fields from the results and does not aggregate or count values. Option C, `rare field_name`, does return values with counts, but it is not marked correct here; it shows the least common values rather than a general unique-value count table. Option E, `dedup field_name`, removes duplicate events based on the field but does not produce counts of each unique value.

Answer

fields field_name

Answer

rare field_name

Answer

dedup field_name

Question 5

Which THREE of the following are valid ways to extract a substring from a field named "full_name" that contains "Firstname Lastname" into separate fields?

Accepted Answer

eval first=split(full_name," ")[0], last=split(full_name," ")[1]. Option B is correct because the eval command's split() function tokenizes full_name on the space delimiter into a multivalue result, and the [0] and [1] indexes extract the first and last name into new fields. Option C is correct because rex applies the regular expression with named capture groups (?\w+) and (?\w+) to full_name, creating the first and last fields directly from the match. Option D is correct because makemv delim=" " converts full_name into a multivalue field split on spaces, and mvindex(full_name,0) and mvindex(full_name,1) then pull the first and last elements into first and last. Option A is not valid because there is no extract command with first= and last= parameters for positional substring extraction. Option E is not valid because the regex command filters events by matching a pattern but does not create or extract new named fields.

Answer

extract field=full_name first=1 last=2

Answer

regex field=full_name "(?[^ ]+) (?[^ ]+)"

Question 6

Refer to the exhibit. What is the purpose of this search?

Accepted Answer

To enrich the server list with current status from the main index.. The search uses `inputlookup` to load a lookup file (server_list), then pipes it into `eval` to create a `status` field set to 'missing'. The `append` command adds all events from the main index (source=main sourcetype=access_combined) that match the server names in the lookup. The `stats values(*) as * by server` merges the two datasets per server, so if a server from the lookup has matching events in the main index, its `status` field will be overwritten with the actual status from the main index (e.g., '200'). Servers with no matching events retain 'missing'. This enriches the lookup data with current status from the main index.

Answer

To compare two datasets and show only matching server names.

Answer

To update the lookup file with current status.

Answer

To find servers that are missing from the lookup.

Question 7

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

Accepted Answer

Add a time range to the main search.. The exhibit shows a transaction command that groups events by a session field, but without a time range, the search must scan all indexed data, which is extremely slow. Adding a time range (e.g., earliest=-1h) limits the data scanned, drastically improving performance while still allowing the transaction to complete within the default maxpause of 5s.

Answer

Change maxpause to 30s.

Answer

Remove the eval command.

Answer

Replace transaction with stats and use values() for fields.

Question 8

A security analyst needs to correlate login events with subsequent actions from the same user within 30 minutes. They need to ensure that only one login per user session is considered, and actions after login are attached. Which command is most appropriate?

Accepted Answer

transaction user maxspan=30m. The transaction command groups events that share a field value (here, user) into a single event as long as they occur within maxspan=30m, which is exactly the requirement to correlate a login with subsequent actions in one session. It also naturally enforces 'one login per session' by treating the login as the start of the transaction and attaching following actions. stats, append, and join do not provide the same session-bounded grouping semantics.

Answer

stats values(user) by _time

Answer

append [search action] | sort user _time

Answer

join user [search login] | timechart

Question 9

A search uses a subsearch to filter events, but the subsearch returns more than 50,000 results, causing the search to fail. Which approach can avoid this limit while still achieving the goal?

Accepted Answer

Use a nested subsearch with stats to aggregate results first.. Using a nested subsearch with `stats` to aggregate results first reduces the number of events returned by the subsearch, allowing it to stay under the default 50,000-result limit. This approach pre-processes the subsearch output (e.g., by counting or grouping) so that the outer search receives a manageable set of values, effectively bypassing the limit without altering system configuration.

Answer

Increase the limit in limits.conf.

Answer

Use a join command instead.

Answer

Use the format command with AND.

Question 10

A user wants to calculate the average response time per user, but only for users who have more than 10 events. Which search approach is efficient?

Accepted Answer

index=web | stats avg(response_time) as avg, count as cnt by user | where cnt>10. It first uses `stats` to compute both the average response time and the event count per user, then filters with `where cnt>10` to keep only users who have more than 10 events. This ensures the average is calculated only after grouping, and the count condition is applied on the aggregated result, which is efficient and accurate.

Answer

index=web | eventstats avg(response_time) as avg by user | where count>10

Answer

index=web | where count>10 | stats avg(response_time) by user

Answer

index=web | stats avg(response_time) as avg by user | where count>10

Question 11

An analyst runs a search that includes a subsearch: `index=web [search index=web status=500 | fields url | dedup url | limit 5]`. The main search returns no results even though the subsearch returns 5 URLs. What is the most likely issue?

Accepted Answer

The subsearch returns multiple values but the main search does not properly use them as a filter.. The subsearch returns a list of 5 URLs, but the main search `index=web [subsearch]` uses these results as a filter. By default, a subsearch returns its results as a single string (or multiple values) that are passed to the main search's `search` command. If the subsearch returns multiple values (e.g., `/page1 /page2 ...`), the main search interprets them as a single search string unless properly formatted with quotes or an `OR` operator. Since the subsearch does not use `format` or `return` to structure the output, the main search likely receives an invalid or empty filter, yielding no results.

Answer

The `limit 5` should be inside the subsearch command, not after dedup.

Answer

The main search index should be different from the subsearch index.

Answer

The subsearch should not use `fields url` because that causes loss of the search command.

Question 12

A search needs to find events where the same user logged in from more than 3 different IP addresses within a 5-minute window. Which combination of commands is most efficient?

Accepted Answer

`| transaction user maxspan=5m | eval distinct_ip=mvcount(src_ip) | where distinct_ip > 3`. The `transaction` command groups events by `user` within a 5-minute window (`maxspan=5m`), then `eval distinct_ip=mvcount(src_ip)` counts the unique IP addresses in that transaction. This directly answers the requirement of finding users who logged in from more than 3 different IPs within a 5-minute window, and it is efficient because `transaction` handles the time-bounded grouping natively without needing to pre-aggregate or use subsearches.

Answer

`| streamstats count by user src_ip | where count > 3`

Answer

`| timechart span=5m limit=0 values(src_ip) by user | eval count=mvcount(values(src_ip)) | where count > 3`

Answer

`| stats count by user, src_ip | where count > 3`

Question 13

A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create a new field called `domain` containing only the domain part?

Accepted Answer

eval domain=mvindex(split(email,"@"),1). `split(email,"@")` creates a multivalue field with two parts: the username (index 0) and the domain (index 1). `mvindex(...,1)` extracts the second element, which is the domain. This is the most direct and efficient way to isolate the domain from an email address in Splunk's eval expression.

Answer

eval domain=mvindex(split(email,"@"),0)

Answer

eval domain=replace(email,".*@(.*)","\1")

Answer

eval domain=substr(email, indexof(email,"@")+1)

Question 14

A search using `tstats` to query a data model returns results but is slow. Which of the following is the most likely cause?

Accepted Answer

The data model is not accelerated.. When a data model is accelerated, Splink pre-computes and stores summaries of the data in a TSIDX index, allowing `tstats` to query these summaries very quickly. If the data model is not accelerated, `tstats` must scan the raw data in the index, which is significantly slower. Therefore, the most likely cause of slow `tstats` performance is that the data model lacks acceleration.

Answer

The data model contains too many fields.

Answer

The search includes a `where` clause on a non-indexed field.

Answer

The search uses `from` instead of `index`.

Question 15

A search `index=main | eval weekday=strftime(_time,"%A") | stats count by weekday | sort - count` shows that Monday has the highest count. However, the user suspects that Monday data is double-counted due to timezone offset. What should be done to investigate?

Accepted Answer

Use `date_wday` field which is based on the local time by default if configured.. The `date_wday` field is automatically calculated based on the user's timezone settings in Splunk, which can help identify if the weekday counts are skewed by timezone differences. Using `date_wday` ensures that the day of the week is determined according to the configured timezone, potentially revealing double-counting or misattribution due to UTC vs local time.

Answer

Use `strftime(_time,"%w")` instead of %A to avoid string comparison issues.

Answer

Apply `| convert timeformat="%A" tz=US/Mountain _time as weekday` to adjust timezone.

Answer

Use `eval weekday=strftime(_time + timezone_offset, "%A")` with a fixed offset.