SPLK-1002 Advanced Searching and Statistics Practice Test 7 — 15 Questions

Question 1

Which TWO of the following searches are syntactically valid uses of the eventstats command? (Assume all referenced fields exist.)

Accepted Answer

| eventstats sum(bytes) as total_bytes by src_ip | eval pct = bytes/total_bytes*100. The `eventstats` command calculates aggregate statistics (here, `sum(bytes)`) over the entire result set or by group (here, `by src_ip`), and it adds the result as a new field (`total_bytes`) to every event. This allows the subsequent `eval` to compute a per-event percentage using that new field. Option C is correct because `eventstats` without a `by` clause computes the aggregate over all events and adds the result (here, `avg`) to each event, enabling the `eval` to calculate the difference from the global average.

Answer

| eventstats perc95(response_time) by host | eval p95 = perc95

Answer

| eventstats values(user) as users by session_id | eval num_users = len(users)

Answer

| eventstats max(_time)last_time by user | table last_time

Question 2

Refer to the exhibit. What does the pct field represent?

Accepted Answer

The percentage of each status within each one-hour time bucket.. The `pct` field in the context of a time-based chart (e.g., `timechart count by status`) represents the percentage of each status value within each one-hour time bucket. This is calculated by dividing the count of a specific status in that bucket by the total count of all statuses in the same bucket, then multiplying by 100. Option C correctly identifies this per-bucket proportional breakdown.

Answer

The running total percentage of events over time.

Answer

The percentage of each status across the entire time range.

Answer

The percentage of events for that status compared to the maximum count in that hour.

Question 3

A large e-commerce company uses Splunk to monitor their web application. They have a query that uses the transaction command to group related events into transactions based on session ID and a 30-minute max pause. The query runs slowly and often times out. The environment has 10 indexers with 4 CPU cores each. The search is run over the last 7 days. Which of the following is the best course of action to improve performance?

Accepted Answer

Replace the transaction command with a combination of stats and streamstats commands.. The `transaction` command is resource-intensive because it groups events by a field (session ID) and a max pause, requiring significant memory and processing to correlate events across the entire search time range. Replacing it with `stats` and `streamstats` is more efficient because `stats` can aggregate events by session ID without the overhead of transaction boundaries, and `streamstats` can compute running totals or windows within each session, leveraging distributed processing across indexers. This approach reduces memory pressure and avoids the timeout issue by using streaming operations that scale better with large datasets.

Answer

Use the eval command to create a transaction ID field and then use stats to group events.

Answer

Reduce the max pause to 15 minutes to limit the number of events in each transaction.

Answer

Increase the number of indexers to 20 to distribute the load.

Question 4

A power user runs a search over the last 24 hours and wants to return only the events that contain the term 'timeout' within the field 'message', but the field 'message' is not extracted by default. Which SPL search will correctly return events where the 'message' field contains 'timeout'?

Accepted Answer

index=app | rex field=_raw "message=(?<message>.+?)(?:\s|$)" | search message="*timeout*". The correct approach extracts the 'message' field from the raw event using rex, then filters on that field. Since the field is not extracted by default, a simple field search would fail. The rex command with a non-greedy capture followed by a search for the term within the field ensures only events where 'message' contains 'timeout' are returned.

Answer

index=app message="timeout"

Answer

index=app | rex field=_raw "message=(?<message>\w+)" | search message="timeout"

Answer

index=app | search message="timeout"

Question 5

An analyst needs to create a report that shows the total count of events and the average response time per URL, but only for URLs that have more than 100 events. The fields are `url` and `response_time`. Which two SPL searches will produce the desired result? (Choose two.)

Accepted Answer

index=web | stats count AS total_count, avg(response_time) AS avg_rt BY url | where total_count > 100. Both valid searches use stats to aggregate by URL and then filter with where on the count. One uses an alias total_count, while the other references the default count field. Both correctly return URLs with more than 100 events along with the average response time.

Answer

index=web | eventstats count AS total_count, avg(response_time) AS avg_rt BY url | where total_count > 100

Answer

index=web | stats count AS total_count, avg(response_time) AS avg_rt BY url | where avg_rt > 100

Answer

index=web | stats count AS total_count, avg(response_time) AS avg_rt BY url | search total_count > 100

Question 6

A network operations team wants a report that shows, for each hour of the last seven days, the average response time and the maximum response time of HTTP transactions, with one row per hour. The raw data contains the numeric field response_ms. Which two search constructs accomplish this goal? (Choose two.)

Accepted Answer

index=web sourcetype=http | bin _time span=1h | stats avg(response_ms) as avg_rt max(response_ms) as max_rt by _time. Both timechart with span=1h and bin combined with stats by _time reduce events into one row per hourly bucket while computing avg and max simultaneously. The timechart approach is the idiomatic single-command solution, while bin plus stats gives identical per-hour aggregation and is preferred when the hourly grouping must coexist with additional BY fields.

Answer

index=web sourcetype=http | stats avg(response_ms) as avg_rt max(response_ms) as max_rt by date_hour

Answer

index=web sourcetype=http | timechart span=1h avg(response_ms) as avg_rt | stats max(response_ms) as max_rt

Answer

index=web sourcetype=http | bucket _time span=1h | eventstats avg(response_ms) as avg_rt max(response_ms) as max_rt

Question 7

A security analyst is searching for events where the field `action` is either `blocked` or `allowed`, but the search `index=firewall action=blocked OR allowed` returns events with action values other than blocked or allowed. Which search corrects the logic so that only events with `action=blocked` or `action=allowed` are returned?

Accepted Answer

index=firewall (action=blocked OR action=allowed). In Splunk SPL, the OR operator has lower precedence than the implicit AND used between search terms. Without parentheses, the search engine evaluates index=firewall AND action=blocked first, then applies OR allowed, which matches any event containing 'allowed' regardless of field. Grouping the two action conditions with parentheses ensures the OR is applied only to the action field, producing the intended results.

Answer

index=firewall action IN (blocked, allowed)

Answer

index=firewall action=blocked OR action=allowed

Answer

index=firewall action=blocked OR index=firewall action=allowed

Question 8

A security analyst runs `index=firewall action=allowed | stats count BY src_ip, dest_port` and gets a large result set. They now want to compare the number of allowed connections per source IP against the total number of connections from that same IP, without re-running the base search. Which command should be added to produce both the per-port count and the per-IP total on each row?

Accepted Answer

eventstats sum(count) AS total_count BY src_ip. eventstats is designed to compute aggregates over the full result set and append the result to every event, preserving the original rows. By aggregating `sum(count)` with a `BY src_ip` clause, each per-port row receives the total for its source IP, enabling direct comparison without losing granularity.

Answer

addtotals sum(count) AS total_count BY src_ip

Answer

streamstats sum(count) AS total_count BY src_ip

Answer

stats sum(count) AS total_count BY src_ip

Question 9

A SOC manager needs a table that lists each department alongside the single most recent login event for that department, including the user and timestamp of that event. Duplicate rows per department are not acceptable. Which search satisfies this requirement?

Accepted Answer

index=auth action=success | sort 0 - _time | dedup department | table department user _time. Ensuring the newest event survives a deduplication requires ordering the events by descending _time before dedup runs, because dedup retains the first occurrence it sees per key. Sorting with sort 0 - _time guarantees the most recent login per department is preserved, and dedup department then reduces the set to one row each, which the table command formats with the correct user and timestamp.

Answer

index=auth action=success | top limit=1 user by department | table department user _time

Answer

index=auth action=success | stats latest(_time) as last_login values(user) as users by department | table department last_login users

Answer

index=auth action=success | dedup department | table department user _time

Question 10

A Splunk administrator needs to create a search that returns the total number of events and the average response time for each host, but only for events where the status code is 200. The administrator also wants to include only hosts that have more than 100 events. Which two SPL commands or clauses are required to achieve this? (Choose two.)

Accepted Answer

stats count AS total_events avg(response_time) AS avg_response BY host. To achieve the desired result, the base search must include status=200 to filter events. Then, the stats command aggregates count and average response time by host. Finally, the where command filters the aggregated results to include only hosts with more than 100 events. The combination of stats and where is essential for post-aggregation filtering.

Answer

dedup host

Answer

eventstats count AS total_events avg(response_time) AS avg_response BY host

Answer

search status=200

Question 11

An analyst needs to identify the top 3 error types by count, but only for the current month, and exclude results with fewer than 100 occurrences. The error type field is `error_type`. Which SPL search is correct?

Accepted Answer

index=app earliest=-1mon@mon latest=@mon | stats count BY error_type | where count >= 100 | sort - count | head 3. To correctly apply all conditions, you must filter after aggregation but before limiting to the top 3. Using stats to count by error_type, then where to enforce the minimum count, then sort and head to get the top 3 ensures that only error types with at least 100 occurrences are considered.

Answer

index=app earliest=-1mon@mon latest=@mon | stats count BY error_type | top limit=3 error_type | where count >= 100

Answer

index=app earliest=-1mon@mon latest=@mon | stats count BY error_type | sort - count | head 3 | where count >= 100

Answer

index=app earliest=-1mon@mon latest=@mon | top limit=3 error_type | where count >= 100

Question 12

A SOC analyst needs to identify the top 5 destination countries by total bytes transferred, but only for traffic that exceeded 1 GB per source IP. The base search returns events with src_ip, dest_country, and bytes fields. Which TWO approaches correctly produce the desired result? (Choose two.)

Accepted Answer

Use `stats sum(bytes) AS total_bytes BY src_ip, dest_country | where total_bytes > 1073741824 | stats sum(total_bytes) AS sum_bytes BY dest_country | sort - sum_bytes | head 5`.. Both valid approaches filter source IPs (or IP-country pairs) exceeding 1 GB before aggregating by destination country. eventstats preserves per-event bytes for later aggregation, while a two-stage stats approach aggregates and then re-aggregates. Both avoid join and field-loss pitfalls.

Answer

Use `stats sum(bytes) AS total_bytes BY src_ip | where total_bytes > 1073741824 | chart sum(bytes) OVER dest_country | sort - sum_bytes | head 5`.

Answer

Use `eventstats sum(bytes) AS total_bytes BY src_ip | where total_bytes > 1073741824 | chart sum(bytes) OVER dest_country | sort - sum_bytes | head 5`.

Answer

Question 13

A power user needs to identify the top 3 source IP addresses by number of failed login attempts, but only for events where the action is 'failure'. The field 'action' is already extracted. Which SPL search is correct?

Accepted Answer

index=security action=failure | stats count by src_ip | sort - count | head 3. The requirement is to find the top 3 source IPs by failed login attempts. The correct approach is to filter for failures, count events per source IP, sort by count descending, and take the top 3. The stats, sort, and head combination achieves this clearly and efficiently.

Answer

index=security action=failure | stats count by src_ip | where count < 3

Answer

index=security action=failure | top limit=3 src_ip

Answer

index=security action=failure | top 3 src_ip

Question 14

A performance team is analyzing web logs with fields response_time and uri_path. They need a report that lists each uri_path with its median response time, and they also need the p95 response time for comparison, in a single result set. (Choose two.)

Accepted Answer

stats median(response_time) AS median_rt, p95(response_time) AS p95_rt BY uri_path. Both required statistics belong in a single stats clause so they are computed per uri_path group and emitted as one row per path. The median function gives the midpoint, while the percentile must be expressed with the percentile function, whose canonical name is perc95 (p95 is accepted shorthand). Commands that attach statistics to raw events or pivot the output do not deliver the requested condensed, side-by-side per-path comparison.

Answer

chart median(response_time) AS median_rt, p95(response_time) AS p95_rt OVER uri_path

Answer

stats median(response_time) AS median_rt, avg(response_time) AS p95_rt BY uri_path

Answer

eventstats median(response_time) AS median_rt, p95(response_time) AS p95_rt BY uri_path

Question 15

A power user needs to analyze web access logs to find the top 5 URLs that returned HTTP status codes in the 4xx range, and also calculate the average response time for each of those URLs. The logs contain fields 'url', 'status', and 'response_time'. Which two SPL searches will produce the desired results? (Choose two.)

Accepted Answer

index=web status>=400 status<500 | stats count avg(response_time) by url | sort - count | head 5. The goal is to find the top 5 URLs with 4xx status codes and their average response time. The efficient way is to use a single stats command that calculates both count and average response time per URL, then sort and limit. Alternatively, a join can be used but is less efficient. The other options either fail to compute the average correctly or do not limit to the top 5.

Answer

index=web status>=400 status<500 | stats count by url | sort - count | head 5 | stats avg(response_time) by url

Answer

index=web status>=400 status<500 | eventstats count by url | where count >= 5 | stats avg(response_time) by url

Answer

index=web status>=400 status<500 | top 5 url | stats avg(response_time) by url