SPLK-1002 Advanced Searching and Statistics Practice Test 5 — 15 Questions

Question 1

A search returns 1000 results per second. The user wants to see a trend of counts over the past hour in 5-minute intervals. Which command should be used?

Accepted Answer

timechart span=5min count. The `timechart` command is designed to create a time-based chart with automatic binning of events into time buckets. By specifying `span=5min`, you explicitly set the bucket size to 5-minute intervals, and `count` calculates the number of events per bucket. This directly satisfies the requirement to see a trend of counts over the past hour in 5-minute intervals.

Answer

chart count over _time span=5min

Answer

stats count by _time span=5min

Answer

streamstats count span=5min

Question 2

Which TWO of the following are valid aggregation functions in the `stats` command? (Choose 2)

Accepted Answer

sum. In Splunk's `stats` command, `sum` (option B) is a valid aggregation function that computes the arithmetic total of a numeric field across events, and `list` (option D) is a valid aggregation function that collects all values of a field into a multivalue field. Both are documented stats functions usable as `stats sum(field)` or `stats list(field)`. The other options are not valid `stats` functions: `median` (A) is not a stats function (percentile-based alternatives like `median()` exist only in some contexts, but not as a standard stats aggregator here), `earliest` (C) is a valid function but belongs to the `stats` command's sibling functions in some contexts—however it is not marked correct here, `distinct_count` (E) is not the correct name (the valid one is `dc` or `distinct_count` is actually valid in some versions, but not marked), and `last` is a valid function but not marked correct. Only the marked options B and D are the correct answers per the question.

Answer

median

Answer

earliest

Answer

distinct_count

Answer

last

Question 3

Which TWO of the following are true about the `transaction` command? (Choose 2)

Accepted Answer

It groups events that share common field values and occur within a specified time window.. Option D is correct because the `transaction` command's core purpose is to group events that share common field values (specified with the `by` clause) and occur within a bounded time span, producing one transaction event per group. Option E is correct because `maxpause` sets the maximum allowed time gap between consecutive events for them to remain in the same transaction; if the gap exceeds this value, a new transaction begins. Option A is incorrect because `startswith`/`endswith` filter which events may begin or end a transaction, but they do not start transactions based on a field value. Option B is incorrect because `transaction` outputs one event per transaction, not one event per input event, and it adds `duration` and `eventcount` fields to the grouped result. Option C is incorrect because the `by` clause is optional; transactions can be grouped by time and other constraints without it.

Answer

Transactions can be started based on a specific field value using the `startswith` option.

Answer

It outputs one event per input event, adding duration and eventcount fields.

Answer

The `by` clause is mandatory to define how to group events.

Question 4

Which TWO of the following commands are useful for reducing the number of events before a `stats` command to improve performance? (Choose 2)

Accepted Answer

head. Option A, `head`, is correct because it limits the result set to the first N events (default 10), so placing it before `stats` reduces the number of events that the stats command must process, directly improving performance. Option E, `fields`, is correct because it includes or excludes specific fields, and using `fields -` to remove unneeded fields (or `fields +` to keep only relevant ones) reduces the data volume passed to `stats`, which speeds up processing. Option B, `transaction`, is not a filtering command; it groups related events into transactions and typically increases processing overhead rather than reducing events before stats. Option C, `sort`, orders events and is computationally expensive, adding work rather than reducing the event count. Option D, `eval`, creates or modifies fields and does not reduce the number of events flowing into `stats`.

Answer

transaction

Answer

sort

Answer

eval

Question 5

Which command is used to convert a multi-value field into individual events?

Accepted Answer

mvexpand. Mvexpand expands multi-value fields into separate events. Option B (makemv) creates multi-value fields. Option C (eval split) also creates multi-value fields. Option D (fields) selects fields.

Answer

eval split

Answer

makemv

Answer

fields

Question 6

A user wants to create a report that shows the top 5 sources of errors, excluding a specific source 'host1'. Which SPL is correct?

Accepted Answer

index=main sourcetype=access_combined status>400 NOT host="host1" | top limit=5 source. It filters out 'host1' before the `top` command runs, ensuring that the top 5 sources of errors are calculated from the remaining data. The `NOT host="host1"` clause is placed in the base search, which is the most efficient approach and guarantees that 'host1' is excluded from the statistical aggregation.

Answer

index=main sourcetype=access_combined status>400 | top limit=5 source | where source!="host1"

Answer

index=main sourcetype=access_combined status>400 | top limit=5 source | search source!="host1"

Answer

index=main sourcetype=access_combined status>400 | search NOT host=host1 | top limit=5 source

Question 7

An administrator notices that a search using the timechart command returns data for every 15-minute bucket even when no events exist, creating many null values. How can this behavior be suppressed?

Accepted Answer

Use timechart cont=false. Cont=false suppresses continuous time bins, showing only buckets with data. Option A (limit=0) affects number of series, not gaps. Option B (usenull=f) is not a valid timechart option. Option C (partial=false) controls partial buckets at edges.

Answer

Use timechart limit=0

Answer

Use timechart usenull=f

Answer

Use timechart partial=false

Question 8

A user runs a search that returns 1,000,000 results but only sees 5,000 in the Statistics tab. What is the most likely cause?

Accepted Answer

The stats command is being used without a by clause. In Splunk, when you use the stats command without a by clause, it aggregates all events into a single row (or a few rows) rather than grouping by a field. This means the Statistics tab will show only the aggregated results, not the individual events. If a user expects to see many rows but sees only 5,000, it is likely because the stats command is aggregating without a by clause, resulting in a small number of rows. The 5,000 limit is a common default for the number of rows displayed in the Statistics tab, but the root cause here is the lack of a by clause.

Answer

The results are being sampled

Answer

The time range is too narrow

Answer

The search command truncates results

Question 9

A search analyst wants to calculate the average transaction time for each user and then find users whose average transaction time exceeds the overall average. Which approach is most efficient?

Accepted Answer

Use stats by user, then eventstats to add overall avg, then where. It first uses `stats by user` to compute per-user average transaction times, then uses `eventstats` to append the overall average across all users to each row, allowing a direct `where` comparison. This approach is efficient because `eventstats` adds the global aggregate without requiring a separate subsearch or additional data pass, minimizing resource usage.

Answer

Use eventstats to add overall average, then stats by user, then where condition

Answer

Use stats by user to get avg, then appendpipe to add overall avg, then eval

Answer

Use transaction to group events, then stats

Question 10

Which of the following is true about the sort command?

Accepted Answer

All of the above. The sort command in Splunk can sort in ascending order by default, can sort by multiple fields, and can use the limit parameter to restrict the number of results. All three statements (B, C, and D) are true, making 'All of the above' the correct choice.

Answer

It only sorts in ascending order by default

Answer

It can sort by multiple fields

Answer

It can use the limit parameter to limit results

Question 11

A user needs to identify the top 3 error types by count, but only for the current month, and exclude results with fewer than 100 occurrences. Which TWO steps are necessary? (Select two.)

Accepted Answer

Use the where command to filter count>=100. Option B is correct because after aggregating events into counts per error type, the where command is the proper way to filter aggregated results, so `where count>=100` removes any error type with fewer than 100 occurrences. Option D is correct because the top command with `limit=3` returns the three highest-count error types in a single step, directly satisfying the 'top 3 error types by count' requirement. Option A is not necessary because setting the time range to 'Current Month' is a UI action, not a required search step, and the scenario can be satisfied with time modifiers in the search itself. Option C is not required because using search with earliest and latest is one way to bound time, but it is not one of the two necessary steps for filtering counts and limiting to three results. Option E is not required because the time command with relative time modifiers is not the standard mechanism for scoping a search to the current month in this context.

Answer

Use the time range picker to set 'Current Month'

Answer

Use the search command with earliest and latest

Answer

Use the time command with relative time modifiers

Question 12

A search administrator wants to ensure that a scheduled search runs efficiently and does not impact other users. Which TWO practices should be implemented? (Select two.)

Accepted Answer

Set the 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range. Option A is correct because explicitly setting dispatch.earliest_time and dispatch.latest_time in the saved search definition bounds the search window, so the scheduler does not scan an unnecessarily wide time range, reducing CPU, memory, and I/O load on the indexers and limiting impact on other users. Option D is correct because enabling auto_summarize on the search builds and uses a summary index, so subsequent scheduled runs read precomputed results instead of re-running the full search over raw data, which dramatically lowers resource consumption. Option B is not appropriate because max_time is a search command argument that limits how long a search runs, but it does not make the search efficient and can silently truncate results. Option C is not appropriate because collect merely writes results into a summary index; it is the reporting acceleration mechanism (auto_summarize) that actually reduces the scheduled search's cost. Option E is not appropriate because the priority setting in savedsearches.conf only affects scheduling order/queueing, not the resource efficiency of the search itself.

Answer

Use the 'max_time' setting in the search command

Answer

Use 'collect' to index summary results

Answer

Use the 'priority' setting in savedsearches.conf

Question 13

A user needs to find events where a user had a failed login followed by a successful login within 10 minutes, and then list the total number of such occurrences per user. Which THREE steps are necessary? (Select three.)

Accepted Answer

Use the stats command to count by user. Option B is correct because after the events are grouped into transactions, the stats command (e.g., stats count by user) is the required way to produce the total number of such occurrences per user. Option D is correct because the transaction command with maxspan=10m is what groups a failed login and a subsequent successful login that occur within a 10-minute window into a single transaction. Option E is correct because transaction must be constrained with startswith and endswith (e.g., startswith=failed endswith=success) so that only transactions beginning with a failure and ending with a success are formed. Option A is not needed because the transaction command's startswith/endswith filters already identify the failure and success events, so no eval field for failure status is required. Option C is not needed because the where command is not the mechanism used to enforce the failure-then-success pairing; that filtering is handled by the transaction command's startswith and endswith arguments.

Answer

Use the eval command to set a field for failure status

Answer

Use the where command to filter transactions with both failure and success

Question 14

Refer to the exhibit. This search is intended to find users with average duration above overall average. However, it returns no results. Why?

Accepted Answer

overall_avg is not available in the where clause because it is created in eventstats. In Splunk, the eventstats command computes aggregate statistics and appends them as fields to each event. However, the where clause is evaluated after eventstats, but the field overall_avg is created by eventstats and is not available in the where clause if the where clause is part of the same eventstats command or if the search is structured incorrectly. The correct approach is to use eventstats to compute overall_avg, then use where to filter. The exhibit likely shows a search where where is used before eventstats or in a way that the field is not yet available.

Answer

eventstats should be after stats

Answer

The where clause should use the 'search' command

Answer

The search requires a subquery to compute overall_avg

Question 15

A large e-commerce company runs Splunk Enterprise on a single indexer cluster with four indexers. They have been experiencing slow search performance during peak hours, especially for searches that cover the last 24 hours. The environment uses a default search time range of 'Last 30 days'. The team has noticed that searches often time out or return partial results. They have also observed high CPU usage on the search head during peak times. The company's data volume is approximately 500 GB per day across various sources. They have implemented some search acceleration for data models, but the issue persists. The security team needs to run ad-hoc searches for threat hunting that cover multiple sourcetypes over the last 7 days. Additionally, the search head has a memory limit that is sometimes reached. The security team's searches are complex and involve joins and subsearches. The existing acceleration only covers a few data models. The team is looking for a quick win that does not require significant infrastructure changes. Which course of action would most effectively improve search performance without compromising data completeness?

Accepted Answer

Reduce the default time range to 'Last 7 days' and encourage users to specify shorter time ranges. Reducing the default time range from 'Last 30 days' to 'Last 7 days' directly reduces the data scanned by searches, which is the most effective quick win without infrastructure changes. Since the environment has high CPU usage on the search head and searches often time out, limiting the default time range reduces the load on the indexers and search head, improving performance for the majority of searches. This change does not compromise data completeness because users can still specify longer time ranges when needed.

Answer

Implement a data model for all sourcetypes and enforce using tstats for all searches

Answer

Increase the number of indexers to distribute the load

Answer

Use the search head clustering feature to distribute search load across multiple search heads