SPLK-1003 Advanced Searching and Statistics Practice Test 7 — 15 Questions

Question 1

A security analyst needs to correlate login events with subsequent actions from the same user within 30 minutes. They need to ensure that only one login per user session is considered, and actions after login are attached. Which command is most appropriate?

Accepted Answer

transaction user maxspan=30m. Option A is correct: 'transaction user maxspan=30m' groups all events from the same user within 30 minutes into a single transaction. Option B does not group; C and D are inefficient for this correlation.

Answer

stats values(user) by _time

Answer

append [search action] | sort user _time

Answer

join user [search login] | timechart

Question 2

A search uses a subsearch to filter events, but the subsearch returns more than 50,000 results, causing the search to fail. Which approach can avoid this limit while still achieving the goal?

Accepted Answer

Use a nested subsearch with stats to aggregate results first.. Option C is correct because using a nested subsearch with `stats` to aggregate results first reduces the number of events returned by the subsearch, allowing it to stay under the default 50,000-result limit. This approach pre-processes the subsearch output (e.g., by counting or grouping) so that the outer search receives a manageable set of values, effectively bypassing the limit without altering system configuration.

Answer

Increase the limit in limits.conf.

Answer

Use a join command instead.

Answer

Use the format command with AND.

Question 3

A user wants to calculate the average response time per user, but only for users who have more than 10 events. Which search approach is efficient?

Accepted Answer

index=web | stats avg(response_time) as avg, count as cnt by user | where cnt>10. Option B is correct because it first uses `stats` to compute both the average response time and the event count per user, then filters with `where cnt>10` to keep only users who have more than 10 events. This ensures the average is calculated only after grouping, and the count condition is applied on the aggregated result, which is efficient and accurate.

Answer

index=web | eventstats avg(response_time) as avg by user | where count>10

Answer

index=web | where count>10 | stats avg(response_time) by user

Answer

index=web | stats avg(response_time) as avg by user | where count>10

Question 4

A user wants to create a timechart showing the number of distinct users per hour over the past week. Which search is correct?

Accepted Answer

index=web | timechart dc(user) span=1h. Option B is correct because the `timechart` command automatically creates a time-based chart with a default or specified `span`, and `dc(user)` calculates the distinct count of users per time bucket. The `span=1h` argument sets the bucket size to one hour, and the `by` clause is not needed because `timechart` implicitly groups by `_time`. This produces the desired output of distinct users per hour over the past week.

Answer

index=web | bucket _time span=1h | stats dc(user) by _time

Answer

index=web | timechart dc(user) by _time span=1h

Answer

index=web | timechart count by user span=1h

Question 5

A search uses the transaction command with maxevents=1000 and maxspan=1h. The search is slow and memory-intensive. Which modification can reduce resource usage while still grouping related events?

Accepted Answer

Reduce maxevents to 100.. Reducing maxevents to 100 limits the number of events that the transaction command groups into a single transaction, which directly reduces memory consumption and processing overhead. This modification still allows related events to be grouped together, but with a smaller batch size, making the search less resource-intensive while preserving the core grouping logic.

Answer

Use eventstats with a time window.

Answer

Use tstats instead of transaction.

Answer

Increase maxspan to 2h.

Question 6

A security analyst runs `index=network sourcetype=firewall | stats count by src_ip | sort - count | head 10` to find the top 10 source IPs by event count. The search returns only 5 results. Which of the following is the most likely reason?

Accepted Answer

There are fewer than 10 unique source IPs in the results.. Option D is correct because the `stats count by src_ip` command groups events by each unique source IP address and counts them. If the search returns only 5 results, it means there are only 5 unique source IPs in the dataset matching the time range and filters. The `head 10` command then limits output to 10 rows, but since only 5 groups exist, only 5 rows are returned.

Answer

The search time range is too short, so only a few events are counted.

Answer

The sort command should be `sort - count` without space.

Answer

The stats command should include a by clause with count in the field list.

Question 7

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

Accepted Answer

`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`. Option C is correct because `eventstats` computes the 95th percentile per service across all events in the result set, adding the value as a new field to each event, and then `stats values(p95) by service` collapses the identical values into a single row per service. This avoids the overhead of time-based bucketing and ensures the percentile is calculated over the entire hour's data in one pass, making it both accurate and efficient.

Answer

`index=main | stats perc95(response_time) by service`

Answer

`index=main | timechart perc95(response_time) by service`

Answer

`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

Question 8

A user wants to add a field showing the average value of a numeric field `latency` for each host, without reducing the number of events. Which command should be used?

Accepted Answer

eventstats. The `eventstats` command is correct because it calculates aggregate statistics (like average) over a field and appends the result as a new field to every event, preserving the original event count. Unlike `stats`, which reduces the dataset to one row per group, `eventstats` enriches each event with the computed value without removing any events.

Answer

eval

Answer

stats

Answer

streamstats

Question 9

An analyst runs a search that includes a subsearch: `index=web [search index=web status=500 | fields url | dedup url | limit 5]`. The main search returns no results even though the subsearch returns 5 URLs. What is the most likely issue?

Accepted Answer

The subsearch returns multiple values but the main search does not properly use them as a filter.. The subsearch returns a list of 5 URLs, but the main search `index=web [subsearch]` uses these results as a filter. By default, a subsearch returns its results as a single string (or multiple values) that are passed to the main search's `search` command. If the subsearch returns multiple values (e.g., `/page1 /page2 ...`), the main search interprets them as a single search string unless properly formatted with quotes or an `OR` operator. Since the subsearch does not use `format` or `return` to structure the output, the main search likely receives an invalid or empty filter, yielding no results.

Answer

The `limit 5` should be inside the subsearch command, not after dedup.

Answer

The main search index should be different from the subsearch index.

Answer

The subsearch should not use `fields url` because that causes loss of the search command.

Question 10

A search needs to find events where the same user logged in from more than 3 different IP addresses within a 5-minute window. Which combination of commands is most efficient?

Accepted Answer

`| transaction user maxspan=5m | eval distinct_ip=mvcount(src_ip) | where distinct_ip > 3`. Option D is correct because the `transaction` command groups events by `user` within a 5-minute window (`maxspan=5m`), then `eval distinct_ip=mvcount(src_ip)` counts the unique IP addresses in that transaction. This directly answers the requirement of finding users who logged in from more than 3 different IPs within a 5-minute window, and it is efficient because `transaction` handles the time-bounded grouping natively without needing to pre-aggregate or use subsearches.

Answer

`| streamstats count by user src_ip | where count > 3`

Answer

`| timechart span=5m limit=0 values(src_ip) by user | eval count=mvcount(values(src_ip)) | where count > 3`

Answer

`| stats count by user, src_ip | where count > 3`

Question 11

A data scientist wants to extract the domain from email addresses in the `_raw` field. The emails follow the pattern user@domain.tld. Which eval expression should be used to create a new field called `domain` containing only the domain part?

Accepted Answer

eval domain=mvindex(split(email,"@"),1). Option A is correct because `split(email,"@")` creates a multivalue field with two parts: the username (index 0) and the domain (index 1). `mvindex(...,1)` extracts the second element, which is the domain. This is the most direct and efficient way to isolate the domain from an email address in Splunk's eval expression.

Answer

eval domain=mvindex(split(email,"@"),0)

Answer

eval domain=replace(email,".*@(.*)","\1")

Answer

eval domain=substr(email, indexof(email,"@")+1)

Question 12

A search using `tstats` to query a data model returns results but is slow. Which of the following is the most likely cause?

Accepted Answer

The data model is not accelerated.. When a data model is accelerated, Splink pre-computes and stores summaries of the data in a TSIDX index, allowing `tstats` to query these summaries very quickly. If the data model is not accelerated, `tstats` must scan the raw data in the index, which is significantly slower. Therefore, the most likely cause of slow `tstats` performance is that the data model lacks acceleration.

Answer

The data model contains too many fields.

Answer

The search includes a `where` clause on a non-indexed field.

Answer

The search uses `from` instead of `index`.

Question 13

A search `index=main | eval weekday=strftime(_time,"%A") | stats count by weekday | sort - count` shows that Monday has the highest count. However, the user suspects that Monday data is double-counted due to timezone offset. What should be done to investigate?

Accepted Answer

Use `date_wday` field which is based on the local time by default if configured.. Option A is correct because `_time` is in UTC; if the events are from timezones where Monday starts earlier or later, using `date_wday` from the local time conversion is more accurate. Option B is wrong because `date_hour` is not needed. Option C is wrong because using `strftime` with timezone is possible but not the most direct. Option D is wrong because converting to epoch does not help.

Answer

Use `strftime(_time,"%w")` instead of %A to avoid string comparison issues.

Answer

Apply `| convert timeformat="%A" tz=US/Mountain _time as weekday` to adjust timezone.

Answer

Use `eval weekday=strftime(_time + timezone_offset, "%A")` with a fixed offset.

Question 14

A search returns 1000 results per second. The user wants to see a trend of counts over the past hour in 5-minute intervals. Which command should be used?

Accepted Answer

timechart span=5min count. The `timechart` command is designed to create a time-based chart with automatic binning of events into time buckets. By specifying `span=5min`, you explicitly set the bucket size to 5-minute intervals, and `count` calculates the number of events per bucket. This directly satisfies the requirement to see a trend of counts over the past hour in 5-minute intervals.

Answer

chart count over _time span=5min

Answer

stats count by _time span=5min

Answer

streamstats count span=5min

Question 15

Which TWO of the following are valid aggregation functions in the `stats` command? (Choose 2)

Accepted Answer

earliest. The `stats` command in Splunk supports `earliest()` as an aggregation function that returns the earliest value of a field for each group. Option C is correct because `earliest()` is a valid stats function that retrieves the first occurrence of a field value within the search results, based on the order of events.

Answer

median

Answer

sum

Answer

distinct_count

Answer

last