SPLK-1002 Advanced Searching and Statistics Practice Test 8 — 15 Questions

Question 1

A Splunk user needs to find the top 5 source IP addresses by number of events, but only for events where the status code is 404. The user also wants to see the count for each IP. Which search accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=web status=404 | top limit=5 src_ip. The top command is designed to return the most frequent values of a field, along with their counts. Using limit=5 restricts the output to the top 5. The base search filters for status=404, ensuring only relevant events are considered. This search efficiently meets the requirement to find the top 5 source IPs by event count for 404 errors.

Answer

index=web status=404 | rare limit=5 src_ip

Answer

index=web status=404 | top src_ip limit=5

Answer

index=web status=404 | stats count BY src_ip | sort - count | head 5

Question 2

An analyst wants to find the top 5 users who have the highest total bytes transferred. The data has fields 'user' and 'bytes'. Which search should be used?

Accepted Answer

| stats sum(bytes) as total_bytes by user | sort - total_bytes | head 5. It uses `stats sum(bytes) as total_bytes by user` to aggregate the total bytes transferred per user, then sorts the results in descending order with `sort - total_bytes`, and finally limits the output to the top 5 users with `head 5`. This directly answers the requirement for the highest total bytes transferred.

Answer

| stats max(bytes) as max_bytes by user | sort - max_bytes | head 5

Answer

| sort - bytes | head 5 | table user, bytes

Answer

| top limit=5 user

Question 3

A search uses 'transaction' to group events by session, but the results show too many transactions with only one event. What is the best way to filter out single-event transactions?

Accepted Answer

| transaction ... | where eventcount > 1. The `transaction` command groups events into transactions, and appending `| where eventcount > 1` filters out any transaction that consists of only a single event. This directly addresses the requirement to remove single-event transactions, as `eventcount` is a default field added by `transaction` that counts the number of events in each transaction.

Answer

Add maxspan=5m to the transaction command

Answer

| transaction maxevents=2 ...

Answer

| transaction ... | where eventcount=2

Question 4

Which TWO of the following statements about the 'stats' command are true?

Accepted Answer

It can be used with a BY clause to group results.. The 'stats' command in Splunk supports a BY clause that allows you to group results by one or more fields, similar to a SQL GROUP BY. This enables you to compute aggregate statistics (e.g., count, sum, avg) for each distinct value of the specified field(s), which is a core feature for summarizing event data.

Answer

The count() function must always include a field argument.

Answer

It creates one event per input event by default.

Answer

It can be used to modify individual field values in raw events.

Question 5

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 6

A search returns many events, and the analyst wants to see a summary table of the top 5 values of the field `src_ip` along with the count of events for each. Which command should be used?

Accepted Answer

top. The `top` command in Splunk is specifically designed to find the most common values of a field and display them in a summary table with counts and percentages. By default, `top` returns the top 10 values, but you can use the `limit=5` parameter to restrict the output to the top 5 values of `src_ip` along with their event counts. This directly meets the analyst's requirement.

Answer

eventstats

Answer

sort

Answer

rare

Question 7

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 8

An analyst runs `index=web status=500 | top 10 uri` and gets results. Which statement is true about the 'top' command's behavior?

Accepted Answer

It counts the number of events per URI and displays the 10 with the highest count.. The `top` command in Splunk counts the occurrences of each distinct value of a specified field (here, `uri`) and returns the values with the highest counts. By default, it returns the top 10 results, so option E correctly describes that it counts events per URI and displays the 10 with the highest count.

Answer

It returns the 10 URIs that appeared most recently.

Answer

It computes the average latency per URI and shows the top 10.

Answer

It sums a numeric field per URI and shows the top 10 sums.

Answer

It requires a 'by' clause to specify the field to group by.

Question 9

A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which search is correct?

Accepted Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`. It uses the `stats` command to compute the average duration and count per user in a single pass, then filters with `where` to enforce both conditions: average duration > 100 and event count > 5. This is the standard pattern for per-user aggregation followed by post-aggregation filtering in Splunk.

Answer

`... | where avg(duration)>100 | stats count by user | where count>5`

Answer

`... | top user limit=0 | where avg(duration)>100`

Answer

`... | eventstats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`

Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | having avg_dur>100 and cnt>5`

Question 10

Which TWO of the following statements about the 'transaction' command are true? (Choose two.)

Accepted Answer

It can add a 'duration' field to the result events.. Option A is correct because the transaction command supports the duration option, which adds a 'duration' field to each resulting transaction event showing the elapsed time between the first and last event in the group. Option E is correct because transaction groups events into a single result when they share common field values (specified via the by clause) and occur within a defined time span (maxspan/maxpause), reflecting logical and temporal proximity. Option B is wrong because transaction expects events sorted in ascending _time order, not descending. Option C is wrong because transaction supports many options such as maxspan, maxpause, maxevents, and mvlist, not just startswith/endswith. Option D is wrong because the by clause is optional; transaction can group events using only time-based constraints.

Answer

It requires events to be sorted by _time in descending order.

Answer

It can only be used with 'startswith' and 'endswith' options.

Answer

It requires at least one field in the 'by' clause.

Question 11

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

Accepted Answer

Change `stats count by uri, method` to `stats count by uri`.. The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer

Add `| where method="GET"` before stats.

Answer

Replace `stats` with `chart count over uri by method`.

Answer

Use `top limit=5 uri, method` instead.

Answer

Add `| stats sum(count) as total by uri` after the existing stats.

Question 12

The following search is executed:
index=web
| rex "GET (?<url>.*)"
| eval category=case(url="/api/v1/data","API", url="/login","Login",1=1,"Other")
| stats count by category

But it returns unexpected results: the count for 'API' is much lower than expected. What is the most likely cause?

Accepted Answer

The regex does not account for the HTTP version string after the URL, causing the URL field to include extra characters like 'HTTP/1.1'.. The regex 'GET (?<url>.*)' is greedy and captures everything after 'GET ' to the end of the line, including the HTTP version (e.g., 'HTTP/1.1'). So url becomes '/api/v1/data HTTP/1.1' instead of '/api/v1/data', and the case() comparison url="/api/v1/data" fails, dumping those events into 'Other' and undercounting API.

Answer

The stats command should use 'count by category' but category is not a field until after eval.

Answer

The case function has a default condition '1==1' that overrides all other conditions.

Question 13

An analyst wants to calculate the average response time for each web server, but only for requests that returned status code 200. Which search accomplishes this?

Accepted Answer

index=web sourcetype=access status=200 | stats avg(response_time) by host. It first filters events with `status=200` (only successful requests), then uses `stats avg(response_time) by host` to compute the average response time per web server. This ensures the aggregation is performed only on the relevant subset of data, matching the requirement precisely.

Answer

index=web sourcetype=access status=200 | sort host | stats avg(response_time)

Answer

index=web sourcetype=access | eval avg_time=avg(response_time) by host | where status=200

Answer

index=web sourcetype=access | stats avg(response_time) by host | search status=200

Question 14

A dashboard is slow to load because it runs a search that uses `transaction` to group events into sessions. The search is `index=main source=web | transaction clientip maxspan=30m maxpause=5m`. What is the most effective way to improve performance?

Accepted Answer

Replace `transaction` with `stats dc(_time) as session_duration by clientip` and use `bin`. Replacing `transaction` with `stats` and `bin` avoids the expensive event grouping and stateful processing that `transaction` requires. The `transaction` command must hold events in memory to correlate them by `clientip` within time windows, which is slow on large datasets. Using `stats dc(_time)` with `bin` computes session metrics more efficiently by aggregating over time buckets without tracking individual event sequences.

Answer

Add `| head 1000` before the `transaction` command

Answer

Set `maxspan=1h` and `maxpause=1m`

Answer

Add `| eval session_id=random()` before transaction

Question 15

Arrange the steps to create a new index in Splunk in the correct order.

Accepted Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Enter index name and configure settings. Step 4: Click Save.. Creating an index involves navigating to the indexes page, adding a new index with appropriate settings, and saving.

Answer

Step 1: Click New Index. Step 2: Navigate to Settings > Indexes. Step 3: Enter index name and configure settings. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Enter index name and configure settings. Step 3: Click New Index. Step 4: Click Save.

Answer

Step 1: Navigate to Settings > Indexes. Step 2: Click New Index. Step 3: Click Save. Step 4: Enter index name and configure settings.