SPLK-1002 Advanced Searching and Statistics Practice Test 9 — 15 Questions

Question 1

Arrange the steps to create a knowledge object of type 'Event Type' in Splunk.

Accepted Answer

Run a search that returns the desired events, then click 'Save As' and select 'Event Type', then enter a name and save.. Event types are created by defining a search string that matches events, then saving with a name.

Answer

Run a search that returns the desired events, then enter a name for the event type, then click 'Save As' and select 'Event Type'.

Answer

Click 'Save As' and select 'Event Type', then run a search that returns the desired events, then enter a name and save.

Answer

Enter a name for the event type, then click 'Save As' and select 'Event Type', then run a search that returns the desired events.

Question 2

Arrange the steps to configure role-based access control in Splunk.

Accepted Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role or edit an existing one. Step 3: Enter a role name. Step 4: Assign desired capabilities (e.g., search, index). Step 5: Set index restrictions and other resource access. Step 6: Click 'Save'.. The correct sequence for configuring role-based access control in Splunk involves first creating or editing a role under Settings > Access Controls > Roles, then assigning capabilities (such as search and index management), followed by setting resource restrictions like index access, and finally saving. This ensures the role is fully defined before being assigned to users. Common mistakes include mixing up the order of capabilities and index restrictions, or mistakenly starting with user assignment.

Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role. Step 3: Enter a role name. Step 4: Set index restrictions first. Step 5: Then assign capabilities. Step 6: Click 'Save'.

Answer

Step 1: Navigate to Settings > Access Controls > Users. Step 2: Assign a role to an existing user. Step 3: Go to Roles and edit the role's capabilities. Step 4: Set index restrictions. Step 5: Save the role.

Answer

Step 1: Navigate to Settings > Access Controls > Roles. Step 2: Click 'New' to create a role. Step 3: Enter a role name. Step 4: Assign capabilities. Step 5: Click 'Save'. Step 6: Later, return to edit the role to add index restrictions.

Question 3

Match each Splunk search command to its primary function.

Accepted Answer

eval: Evaluate expressions and assign to new fields. These are common Splunk search commands used for data manipulation and enrichment.

Answer

eval: Extract fields using regular expressions

Answer

stats: Enrich events with data from external sources

Question 4

Which command adds the overall average of a field to each event in the results?

Accepted Answer

eventstats avg(latency) as avg_latency. The `eventstats` command computes aggregate statistics (like `avg(latency)`) over the entire result set and adds the result as a new field to every event, preserving all original events. This matches the requirement to add the overall average to each event. In contrast, `stats` collapses events into a single summary row, `streamstats` computes a running average per event, and `timechart` produces a time-based chart, none of which add the overall average to every original event.

Answer

streamstats avg(latency) as avg_latency

Answer

timechart avg(latency) as avg_latency

Answer

stats avg(latency) as avg_latency

Question 5

A search uses `transaction maxspan=30s maxpause=5s`. Events are sorted by _time. If there is a gap of 10 seconds between two events, what happens?

Accepted Answer

They are split into separate transactions because the gap exceeds maxpause.. The `maxpause` parameter in the `transaction` command defines the maximum allowed gap between consecutive events within the same transaction. Since the gap of 10 seconds exceeds the `maxpause=5s`, the events are split into separate transactions, regardless of the `maxspan=30s` limit. The `maxspan` only sets an upper bound on the total duration of the transaction from the first to the last event, but it does not override the pause-based splitting logic.

Answer

They are merged because maxpause is 5s but maxspan is 30s, so the 10s gap is within maxspan.

Answer

They are considered part of the same transaction as long as total span ≤ 30s.

Answer

They are split only if the total span exceeds maxspan.

Question 6

Which command returns the list of all sourcetypes in a specific index?

Accepted Answer

| metadata type=sourcetypes index=main. The `| metadata` command with `type=sourcetypes` retrieves a list of all sourcetypes present in a specified index, along with their earliest and latest timestamps. This command queries the index metadata directly, making it the appropriate tool for listing sourcetypes within a given index.

Answer

| sourcetype count index=main

Answer

| eventtype count index=main

Answer

| metasearch index=main sourcetype=*

Question 7

Which command creates a time-based chart showing a count of events over time?

Accepted Answer

| timechart count. `timechart count` is the correct command for a time-based chart of event count. The `timechart` command automatically buckets by `_time`, so `by _time` is unnecessary and invalid as a timechart split-by field. `chart count over _time` is not a timechart command, and `timecount` is not a valid Splunk command.

Answer

| timecount

Answer

| timechart count by _time

Answer

| chart count over _time

Question 8

Which THREE of the following are valid Splunk search commands?

Accepted Answer

regex. The three valid Splunk search commands among the options are regex (A), dedup (B), and sort (C). The regex command (A) is a legitimate Splunk search command that filters or extracts fields using regular expressions, e.g., `... | regex field=pattern`. The dedup command (B) is valid and removes duplicate events or field values, e.g., `... | dedup field`. The sort command (C) is valid and orders results by specified fields, e.g., `... | sort -count`. Options D (filter) and E (parse) are not Splunk search commands; filtering is done via the search command or where, and parsing is handled by commands like rex, extract, or spath, not a command named parse.

Answer

filter

Answer

parse

Question 9

Refer to the exhibit. What is the result of this search?

Accepted Answer

A table of users and their total counts, sorted by count descending, limited to 5 rows.. The search uses the `top` command, which by default returns the most common values of a field sorted by count in descending order, limited to 10 results. The `limit=5` parameter overrides the default to return only the top 5 users. The `countfield` option renames the count column to 'total', and the `showcount=f` hides the percent column, producing a table of users and their total counts sorted by count descending, limited to 5 rows.

Answer

A list of all users sorted by count ascending.

Answer

The first 5 events with failed password.

Answer

The top 5 users by username alphabetically.

Question 10

A security analyst wants to calculate the average latency for each web server over the past hour, but only for requests where the status code is 200. The search result includes fields: server, latency, status. Which search correctly accomplishes this?

Accepted Answer

index=web sourcetype=access status=200 | stats avg(latency) by server. It filters events to only those with status=200 before the stats command, ensuring the average latency is calculated exclusively over successful requests. The stats command then computes the average latency grouped by server, which directly answers the requirement without needing conditional logic or post-filtering.

Answer

index=web sourcetype=access | eval good_latency=if(status=200, latency, null) | stats avg(good_latency) by server

Answer

index=web sourcetype=access | eventstats avg(latency) by server | where status=200

Answer

index=web sourcetype=access | stats avg(latency) by server | where status=200

Question 11

An analyst wants to create a running total of sales per day over a week. The data has fields: date, sales. Which search would produce a cumulative sum for each day?

Accepted Answer

... | sort date | streamstats sum(sales) as running_total. It first sorts the events by date to ensure chronological order, then uses `streamstats` to compute a running (cumulative) sum of sales across each event in that order. `streamstats` processes events sequentially and adds the current value to the accumulated total, producing a cumulative sum per day.

Answer

... | eval running_total = running_sum(sales)

Answer

... | eventstats sum(sales) as running_total

Answer

... | stats sum(sales) by date

Question 12

A search uses eventstats to add the average response time per server to each event. Which of the following correctly describes the output?

Accepted Answer

Each event retains its original fields and gains the average response time for its server.. The `eventstats` command in Splunk computes aggregate statistics (like average) over a specified field grouping and then appends the result to every original event, not just one per group. In this case, it calculates the average response time per server and adds that value as a new field to each event that belongs to that server, preserving all original fields and events.

Answer

Only one event per server is returned, showing the average response time.

Answer

A running average is calculated across all events.

Answer

Events are grouped by server and the top values are listed.

Question 13

Which THREE of the following are benefits of using eventstats over stats when analyzing event logs? (Choose three.)

Accepted Answer

The original number of events is preserved.. Option A is correct because eventstats enriches each original event with the computed aggregate values rather than collapsing the result set, so the original number of events is preserved. Option C is correct because the aggregated fields produced by eventstats are added to each event and can therefore be referenced in later commands such as where, eval, or sort. Option E is correct because, since each event retains its own fields plus the aggregate values, you can inspect individual event details alongside the aggregate statistics. Option B is incorrect because eventstats generally consumes more memory than stats, since it must retain and enrich every event instead of reducing them to aggregate rows. Option D is incorrect because eventstats is not always faster than stats; it typically performs additional work to attach aggregates to each event, so performance depends on the search.

Answer

It uses less memory than stats.

Answer

It is always faster than stats.

Question 14

A security analyst notices that a timechart command is returning too many data points on the x-axis, making the chart unreadable. Which command modification should be used to reduce the number of data points?

Accepted Answer

| timechart span=1h count by host. The `timechart` command automatically bins events into time buckets based on the time range. By default, Splunk chooses a span that can result in many data points. Adding `span=1h` explicitly sets the bucket size to one hour, reducing the number of data points on the x-axis and making the chart readable.

Answer

| timechart partial=f count by host

Answer

| timechart useother=f count by host

Answer

| timechart limit=5 count by host

Question 15

Which SPL command can be used to create a new field based on a conditional evaluation, such as setting a status field to 'critical' if a numeric threshold is exceeded?

Accepted Answer

| eval status=if(value>100,"critical","normal"). The `eval` command in SPL is used to create new fields or modify existing ones by evaluating expressions. The `if()` function within `eval` allows conditional logic, making `| eval status=if(value>100,"critical","normal")` the correct syntax to create a new field 'status' that is set to 'critical' when the numeric field 'value' exceeds 100, and 'normal' otherwise.

Answer

| makemv

Answer

| rex field=_raw

Answer

| convert status=if(value>100,"critical","normal")