SPLK-1003 Advanced Searching and Statistics Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. Which statement about this search is true?

Accepted Answer

It adds geographical info based on src_ip and then aggregates bytes by dest_ip and country.. The search uses `iplocation` to add geographical fields (like Country, City) based on the `src_ip` field, then renames `src_ip` to `src` and uses `stats` to aggregate bytes by `dest_ip` and the newly added `Country` field. This matches option D exactly.

Answer

It fails because iplocation requires a lookup table to be defined.

Answer

It uses iplocation to add geographical information about the destination IP.

Answer

It only includes events where src_ip is a valid IP address.

Question 2

Refer to the exhibit. What does the final result represent?

Accepted Answer

Hours where any user's logon count is more than double the average for that hour.. The `eventstats` command calculates a per-hour average logon count across all users. The `where` clause then filters for events where a specific user's logon count for that hour is more than double that hourly average. This directly matches option C: hours where any user's logon count exceeds twice the average for that hour.

Answer

Users who log on more than twice on average.

Answer

Hours where the total logon count is more than double the average.

Answer

Users who have a logon count greater than twice their personal average.

Question 3

A search is running slowly due to a large data volume. Which TWO modifications are likely to improve search performance? (Select two.)

Accepted Answer

Reduce the time range of the search.. Reducing the time range limits the volume of data scanned by the search head, directly reducing I/O and processing overhead. This is one of the most effective ways to improve search performance because Splunk must read and filter every event in the specified time window from the index.

Answer

Use wildcard characters at the beginning of search terms.

Answer

Use the transaction command to group events.

Answer

Use the dedup command as early as possible.

Question 4

An analyst wants to create a time-series comparison of the current week and the previous week. Which TWO commands are commonly used together to achieve this? (Select two.)

Accepted Answer

timechart. B is correct because `timechart` is the primary command for creating time-series aggregations, allowing you to split data into time buckets and apply statistical functions. D is correct because `timewrap` is specifically designed to compare time periods (e.g., current week vs. previous week) by wrapping the time-series data into separate series for each period, enabling side-by-side visualization.

Answer

stats

Answer

eventstats

Answer

appendcols

Question 5

Which THREE of the following are valid uses of the stats command? (Select three.)

Accepted Answer

Calculating the average of a field across all events.. The `stats` command in Splunk is used to perform statistical aggregations on search results. Option A is correct because `stats avg(field)` calculates the arithmetic mean of a specified field across all events in the result set. Option B is correct because `stats earliest(_time) by category` returns the minimum timestamp for each distinct value of the category field, which is a standard use of the `earliest()` function. Option C is correct because `stats count by category` groups events by the categorical field and returns the number of events in each group, a fundamental aggregation pattern.

Answer

Creating a time-based chart with multiple series.

Answer

Enriching events with fields from an external lookup.

Question 6

A security analyst wants to find IP addresses that have attempted to access a specific URL more than 5 times in the last hour and also have a user agent string containing "curl". They need to use a subsearch to pre-filter IPs. Which search is correct?

Accepted Answer

index=web sourcetype=access [search useragent=*curl* | stats count by src_ip | where count>5 | fields src_ip] | stats count by src_ip | where count>5. Option B is correct because it uses a subsearch to first find IPs that have accessed the URL more than 5 times with a user agent containing 'curl', then passes those IPs to the outer search to filter the original data. The subsearch returns a list of src_ip values, which the outer search uses as a filter, ensuring only IPs meeting both conditions are counted again. This matches the requirement to pre-filter IPs using a subsearch.

Answer

[search index=web sourcetype=access useragent=*curl* | stats count by src_ip | where count>5] | fields src_ip

Answer

index=web sourcetype=access | search useragent=*curl* | stats count by src_ip | where count>5

Answer

index=web sourcetype=access ( useragent=*curl* ) | stats count by src_ip | where count>5

Question 7

A team uses a large index with many sourcetypes. They want to find events where the field "status" contains either "error" or "failure" (case-insensitive), and also ensure that "response_time" > 1000. Which search best optimizes performance?

Accepted Answer

index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5. Option D is correct because it efficiently computes both the average response_time and the count of events per category in a single stats command, then filters by count >=100, sorts by average descending, and returns the top 5 categories. This minimizes data movement and processing by performing all aggregations in one pass, which is optimal for large indexes with many sourcetypes.

Answer

Answer

index=main | top category | eval avg=avg(response_time) | where count>=100

Answer

index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

Question 8

A user wants to create a chart showing the count of errors per hour for the last 24 hours, with time bucketed hourly. Which search is correct?

Accepted Answer

index=main error | timechart count span=1h. Option A is correct because the `timechart` command automatically creates a time-based chart with a default count aggregation. The `span=1h` argument explicitly sets the bucket size to one hour, which groups events into hourly intervals over the last 24 hours. This produces the exact output the user needs: a count of errors per hour.

Answer

index=main error | bucket _time span=1h | stats count by _time

Answer

index=main error | chart count by _time span=1h

Answer

index=main error | timechart count by _time span=1h

Question 9

Which TWO of the following commands can be used to create a table of unique values for a field, along with their counts?

Accepted Answer

stats count by field_name. The `stats count by field_name` command groups events by the unique values of the specified field and outputs a table with each value and its count. The `top field_name` command also produces a table of the most frequent field values along with their counts, sorted in descending order by count. Both commands generate the required table of unique values with counts.

Answer

fields field_name

Answer

rare field_name

Answer

dedup field_name

Question 10

Which TWO search commands can be used to calculate a running total (cumulative sum) of a field over time?

Accepted Answer

accum. B is correct because the `accum` command calculates a cumulative sum of a specified numeric field across all events in the search result order, adding each event's value to the running total. This directly implements a running total without requiring any additional options.

Answer

delta

Answer

transaction

Answer

eventstats

Question 11

Which THREE of the following are valid ways to extract a substring from a field named "full_name" that contains "Firstname Lastname" into separate fields?

Accepted Answer

eval first=split(full_name," ")[0], last=split(full_name," ")[1]. Option B is correct because the `split` function in Splunk's `eval` command returns a multivalue field from a string based on a delimiter, and array indexing with `[0]` and `[1]` extracts the first and second elements respectively. This directly splits "Firstname Lastname" into two separate fields named `first` and `last`.

Answer

extract field=full_name first=1 last=2

Answer

regex field=full_name "(?[^ ]+) (?[^ ]+)"

Question 12

Refer to the exhibit. What will this search return?

Accepted Answer

A time-based chart with a line for each host showing count of 404 events per time period.. The search uses `timechart` with `by host`, which produces a time-based chart where each host is a separate series (line) showing the count of events where `status=404` over each time bucket. The `count` function aggregates the number of 404 events per time period, and the `by host` clause splits the results into separate lines per host. Option B correctly describes this output.

Answer

A list of events with status 404.

Answer

A table with columns for each host and a row for each time bucket showing count of 404 errors.

Answer

A bar chart of total 404 errors per host.

Question 13

Refer to the exhibit. What is the purpose of this search?

Accepted Answer

To enrich the server list with current status from the main index.. The search uses `inputlookup` to load a lookup file (server_list), then pipes it into `eval` to create a `status` field set to 'missing'. The `append` command adds all events from the main index (source=main sourcetype=access_combined) that match the server names in the lookup. The `stats values(*) as * by server` merges the two datasets per server, so if a server from the lookup has matching events in the main index, its `status` field will be overwritten with the actual status from the main index (e.g., '200'). Servers with no matching events retain 'missing'. This enriches the lookup data with current status from the main index.

Answer

To compare two datasets and show only matching server names.

Answer

To update the lookup file with current status.

Answer

To find servers that are missing from the lookup.

Question 14

Refer to the exhibit. The search is taking very long and returning few results. Which change would most improve performance?

Accepted Answer

Add a time range to the main search.. The exhibit shows a transaction command that groups events by a session field, but without a time range, the search must scan all indexed data, which is extremely slow. Adding a time range (e.g., earliest=-1h) limits the data scanned, drastically improving performance while still allowing the transaction to complete within the default maxpause of 5s.

Answer

Change maxpause to 30s.

Answer

Remove the eval command.

Answer

Replace transaction with stats and use values() for fields.

Question 15

A user wants to see the top 5 most common HTTP methods (field "method") from web access logs, along with their percentage of total. Which search is best?

Accepted Answer

index=web | top method limit=5 showperc=t. Option C is correct because `top` with `limit=5` returns the five most common values of the `method` field, and `showperc=t` automatically calculates and displays each value's percentage of the total events. This directly meets the requirement to see the top 5 HTTP methods and their percentages without needing additional commands.

Answer

index=web | top method countfield=percent

Answer

index=web | eventstats count | top method

Answer

index=web | stats count by method | sort - count | head 5

SPLK-1003 Advanced Searching and Statistics Practice Test 6 — 15 Questions

Exhibit

SPLK-1003 Advanced Searching and Statistics Practice Test 6 — 15 Questions

Exhibit