SPLK-1002 Advanced Searching and Statistics Practice Test 6 — 15 Questions

Question 1

A user wants to find the top 5 sourcetypes by event count over the last 24 hours. Which search is correct?

Accepted Answer

index=* | stats count by sourcetype | sort -count | head 5. The search `index=* | stats count by sourcetype | sort -count | head 5` correctly counts events per sourcetype, sorts by count in descending order, and returns the top 5. This uses the stats command to aggregate, sort to order, and head to limit, which is the standard Splunk approach for top N results.

Answer

index=* | eventcount | top sourcetype

Answer

index=* | stats count by sourcetype | top 5 sourcetype

Answer

index=* | top sourcetype

Question 2

A Splunk admin notices that a search using the transaction command takes too long. To debug, they want to see how events are grouped into transactions before the transaction command runs. Which command can be added to the search pipeline before transaction to inspect the grouping?

Accepted Answer

streamstats. The streamstats command is correct because it can compute running statistics (like event counts or time gaps) over a sliding window of events, allowing the admin to see how events might be grouped before the transaction command actually groups them. By adding streamstats before transaction, the admin can inspect intermediate results such as the running count of events per potential transaction key or the time difference between consecutive events, which helps debug why transaction is slow or grouping unexpectedly. This is a common Splunk debugging technique to visualize transaction grouping logic without the overhead of the transaction command itself.

Answer

map

Answer

fields

Answer

transaction

Question 3

To count events by host for the last hour, which search is most efficient?

Accepted Answer

index=* earliest=-1h | stats count by host. It uses `index=*` to search all indexes and `earliest=-1h` to restrict the search to the last hour at the index level, which is the most efficient way to filter time. The `stats count by host` then aggregates counts per host without needing to process events outside the time range. This approach leverages Splunk's time-based index pruning, minimizing data scanned.

Answer

index=* | stats count by host | where _time > relative_time(now(), "-1h")

Answer

search index=* | head 1000 | stats count by host

Answer

sourcetype=access_combined | timechart count by host

Question 4

You need to find the percentage of total events contributed by each sourcetype. Which command should follow index=* | stats count by sourcetype?

Accepted Answer

eventstats sum(count) as total | eval percent = count/total*100. The [CORRECT] option uses eventstats to compute the sum of count across all sourcetype rows and append it as a new field 'total' to every event, then eval divides each row's count by that total and multiplies by 100. This is the canonical Splunk pattern for percentage-of-total because eventstats performs streaming aggregation that preserves the original rows, unlike stats which collapses them. The result is one row per sourcetype with a percent field.

Answer

addtotals

Answer

eval percent = count / sum(count) * 100

Answer

appendpipe [stats sum(count) as total] | eval percent = count/total*100

Question 5

A search includes a subsearch that returns 100,000 results, causing performance issues. Which optimization is best?

Accepted Answer

Use limit in the subsearch to return fewer results. Using the `limit` command in a subsearch restricts the number of results returned to the primary search, directly reducing the data volume that must be processed and joined. This is the most effective optimization when a subsearch returns a large result set (e.g., 100,000 events), as it minimizes memory and CPU overhead in the search head.

Answer

Use the fields command inside the subsearch

Answer

Use the format command inside the subsearch

Answer

Use the search command with index=* inside the subsearch

Question 6

To find users who logged in from more than 3 different IP addresses, which search is correct?

Accepted Answer

index=auth | stats dc(IP) by user | where dc(IP) > 3. It uses `stats dc(IP) by user` to count distinct IP addresses per user, then filters with `where dc(IP) > 3` to return only users who logged in from more than 3 different IPs. The `dc()` function calculates distinct count, which is exactly what the question requires.

Answer

index=auth | top limit=3 IP by user

Answer

index=auth | eval user, IP | dedup user, IP | stats count by user | where count > 3

Answer

index=auth | stats distinct_count(IP) by user | where distinct_count(IP) > 3

Question 7

Which TWO of the following are valid ways to calculate the median of a numeric field?

Accepted Answer

stats p50(field). Option D is correct because the stats command supports the p50(field) aggregation function, which computes the 50th percentile of the numeric field — exactly the definition of the median. Option E is correct because stats also provides the median(field) aggregation function as a direct, built-in way to calculate the median of a numeric field. Options A, B, and C are not valid: percentile(field, 50) is not a recognized eval function, eventstats does not support a median(field) function in that form, and perc(field, 50) is not a valid stats aggregation function (the correct percentile-style function is p50 or perc with the proper syntax).

Answer

eval median = percentile(field, 50)

Answer

eventstats median(field)

Answer

stats perc(field, 50)

Question 8

Which TWO of the following commands can be used to find the most frequent value of a field within each group?

Accepted Answer

stats mode(field) by group. Option A, `stats mode(field) by group`, is correct because the `stats` command with the `mode()` function returns the most frequently occurring value of the field for each distinct group defined by the `by` clause. Option E, `eventstats mode(field) by group`, is also correct because `eventstats` computes the same `mode()` aggregate per group but adds the result back to each original event as a new field, still yielding the most frequent value per group. Option B is not correct because `list()` collects all values into a multivalue field and `mvindex(...,0)` merely returns the first value in order of appearance, not the most frequent one. Option C is not correct because `streamstats` computes running/cumulative statistics over events in order, so `mode(field)` there reflects the running mode up to each event rather than the overall most frequent value per group. Option D is not correct because `values()` returns the distinct values of the field as a multivalue field, not the single most frequent value.

Answer

stats list(field) by group | eval top = mvindex('list', 0)

Answer

streamstats mode(field) by group

Answer

stats values(field) by group

Question 9

A security analyst is investigating a potential breach. They have a search that uses the transaction command to group events by session_id and calculates the total bytes transferred per session. However, the search takes over 30 minutes to complete on a 24-hour time range. The environment has 10 indexers with default settings. The analyst needs to reduce search time while preserving the ability to group by session_id. Which course of action should they take?

Accepted Answer

Pre-aggregate events by session_id using 'stats values(*) as * sum(bytes) as total_bytes by session_id' before the transaction command.. Pre-aggregating events by session_id using stats with values(*) and sum(bytes) before the transaction command reduces the number of events the transaction command must process. The transaction command is resource-intensive as it correlates events across time; fewer input events significantly decrease execution time. The stats command runs in parallel across indexers, maintaining distributed processing. Other options: B adds overhead via subsearch, C (streamstats) does not group events like transaction, and D forces single-indexer processing, slowing performance.

Answer

Use an append command to add a subsearch that pre-filters events.

Answer

Replace transaction with the 'streamstats' command to compute running totals.

Answer

Add the 'local' keyword to the transaction command to force it to run on a single indexer.

Question 10

A network operations team uses Splunk to analyze firewall logs. They need to identify top talkers (source IPs with highest total bytes) over the last hour. The current search: 'index=firewall | stats sum(bytes) as totalBytes by src_ip | sort -totalBytes | head 10' takes 5 minutes to complete. They want to make it faster. The environment has 5 indexers with default configurations. The data volume is 100 GB/day. Which action will most improve search performance?

Accepted Answer

Add 'earliest=-1h' to the search to restrict the time range explicitly.. Explicitly adding 'earliest=-1h' restricts the search to the last hour at the search head level, allowing Splunk to use time-based index metadata to skip irrelevant buckets entirely. Without an explicit time range, Splunk may scan all available data, dramatically increasing I/O and search time. This is the most impactful optimization for time-bound searches over large datasets.

Answer

Replace head 10 with limit 10 at the end of the pipeline.

Answer

Use map to run the search per indexer.

Answer

Set the search's parallelism to 'auto' in the commands.

Question 11

A developer wants to debug a slow Splunk search that uses multiple eval and where commands. The search returns correct results but takes 2 minutes. The developer wants to identify which parts of the search are slow. The environment is a single instance Splunk with moderate data. What should the developer do?

Accepted Answer

Run the search with the 'search job inspector' option enabled.. The Search Job Inspector provides detailed per-command execution statistics, including time spent, number of results, and memory usage for each pipe segment. This allows the developer to pinpoint exactly which `eval` or `where` command is causing the slowdown, without altering the search logic or time range.

Answer

Manually check the search in the Job Manager after it completes.

Answer

Limit the time range to 1 minute and run the search.

Answer

Add comments to the search to track progress.

Question 12

Which TWO commands can be used to perform statistical aggregations on streaming events without creating a separate search results set?

Accepted Answer

streamstats. Options D (eventstats) and C (streamstats) are correct because both are Splunk transforming commands that compute statistical aggregations (such as count, avg, sum, dc) and add the results as new fields to each event in the pipeline, rather than replacing the events with a separate aggregated results table. eventstats computes the aggregation across the entire result set and appends the value to every event, while streamstats computes the aggregation incrementally as events stream through, also enriching each event in place. Because the original events are preserved and enriched, no separate search results set is created, which matches the scenario requirement. The unmarked options do not belong: A (timechart) and E (chart) are transforming commands that produce a new tabular/chart results set instead of enriching the original events, and B (stats) likewise replaces the incoming events with an aggregated results table rather than adding fields to each event.

Answer

timechart

Answer

stats

Answer

chart

Question 13

A Splunk environment ingests 10 TB per day. A user runs a search to count events per sourcetype over the last 7 days: `index=* earliest=-7d | timechart count by sourcetype`. The search returns partial results and eventually times out. The user needs to obtain the complete results efficiently. What is the best course of action?

Accepted Answer

Use `| tstats count where index=* earliest=-7d by _time span=1d, sourcetype` and then format as needed.. `tstats` runs on indexed metadata (tsidx files) rather than raw events, making it far more efficient for counting events over large time ranges. By specifying `by _time span=1d, sourcetype`, you get daily counts per sourcetype without scanning the entire event data, avoiding the timeout that occurs with a raw search over 10 TB/day for 7 days.

Answer

Use `| bucket span=1d | stats count by _time sourcetype` then `| xyseries` to format.

Answer

Use `| sitime` to sample the data and approximate counts.

Answer

Break the search into 1-day intervals and use `append` to combine results.

Question 14

A user needs a report showing the number of distinct source IPs per sourcetype over the last hour. They run: `index=* earliest=-1h | stats dc(src_ip) by sourcetype`. The search runs slowly (2 minutes) and they want to speed it up. Which optimization is most effective?

Accepted Answer

Use `| tstats dc(src_ip) where index=* earliest=-1h by sourcetype`.. The tstats command queries the indexed fields in Splunk's TSIDX (time-series index) files directly, bypassing the need to load raw events and extract fields at search time. Because src_ip and sourcetype are typically indexed or accelerated fields, tstats can compute dc(src_ip) by sourcetype orders of magnitude faster than a raw 'stats dc()' search. This is the standard Splunk optimization for high-cardinality aggregation over large time ranges.

Answer

Use `| top limit=100 sourcetype` to get top sourcetypes.

Answer

Use `| stats count by sourcetype, src_ip | stats count by sourcetype`.

Answer

Use `| chart count over sourcetype by src_ip`.

Question 15

A security analyst wants to create a comparison report showing the count of login failures by user for today versus yesterday. They run: `index=security action=failure | timechart count by user`. This produces a chart of counts over time, but they want separate columns for today and yesterday. How can they achieve this comparison efficiently?

Accepted Answer

Use `| eval day=if(_time>=relative_time(now(),"@d"),"today","yesterday") | timechart count by user by day`.. The `eval` command with `if()` and `relative_time()` dynamically tags each event as 'today' or 'yesterday' based on its `_time`, then `timechart count by user by day` produces a split-by-column chart with one column per day per user. This is a single-pass search that leverages the existing time range and avoids subsearch overhead. It efficiently delivers the today-vs-yesterday comparison the analyst needs.

Answer

Use `| append [search index=security action=failure earliest=-2d@d latest=-1d@d | eval period="yesterday"] | timechart count by user by period`.

Answer

Use `| stats count by user _time | xyseries _time user count`.

Answer

Use `| timechart count by user useother=t` with the time range set to 'Yesterday' and 'Today' in the time picker.