SPLK-1003 Advanced Searching and Statistics Practice Test 9 — 15 Questions

Question 1

A search administrator wants to ensure that a scheduled search runs efficiently and does not impact other users. Which TWO practices should be implemented? (Select two.)

Accepted Answer

Set the 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range. Option A is correct because setting 'dispatch.earliest_time' and 'dispatch.latest_time' to a specific time range limits the data scanned by the scheduled search, reducing resource consumption and preventing it from impacting other users. Option D is correct because enabling 'auto_summarize' on the search creates pre-computed summary tables that allow the scheduled search to run against summarized data rather than raw events, drastically improving efficiency and reducing system load.

Answer

Use the 'max_time' setting in the search command

Answer

Use 'collect' to index summary results

Answer

Use the 'priority' setting in savedsearches.conf

Question 2

A user needs to find events where a user had a failed login followed by a successful login within 10 minutes, and then list the total number of such occurrences per user. Which THREE steps are necessary? (Select three.)

Accepted Answer

Use the stats command to count by user. Options A, B, and C are correct. The transaction command (A) with maxspan=10m groups events, and startswith/endswith (B) define the transaction boundaries. Then stats (C) counts the transactions per user. Option D is not needed because transaction ensures the pattern. Option E is not necessary as fields exist.

Answer

Use the eval command to set a field for failure status

Answer

Use the where command to filter transactions with both failure and success

Question 3

Refer to the exhibit. This search returns an error. What is the most likely cause?

Accepted Answer

The timechart command requires a _time field which is not present after stats. The error occurs because the `stats` command removes the `_time` field from the events, and `timechart` requires a valid `_time` field to create time-based buckets. Without `_time`, `timechart` cannot generate the time axis, resulting in a search error. This is a common pitfall when chaining `stats` before `timechart` without preserving the time field.

Answer

The eval command cannot be used before timechart

Answer

The status_group field is not available after timechart because it was created in eval

Answer

The stats command aggregates data, so timechart cannot use the aggregated count field

Question 4

Refer to the exhibit. This search is intended to find users with average duration above overall average. However, it returns no results. Why?

Accepted Answer

overall_avg is not available in the where clause because it is created in eventstats. Option B is correct: eventstats adds overall_avg to each event, but stats by user only outputs user and user_avg, dropping overall_avg, so where compares a non-existent field to user_avg. Option A is wrong because eventstats before stats is correct conceptually. Option C is wrong because where works fine with fields present. Option D is wrong as subquery is not needed.

Answer

eventstats should be after stats

Answer

The where clause should use the 'search' command

Answer

The search requires a subquery to compute overall_avg

Question 5

A large e-commerce company runs Splunk Enterprise on a single indexer cluster with four indexers. They have been experiencing slow search performance during peak hours, especially for searches that cover the last 24 hours. The environment uses a default search time range of 'Last 30 days'. The team has noticed that searches often time out or return partial results. They have also observed high CPU usage on the search head during peak times. The company's data volume is approximately 500 GB per day across various sources. They have implemented some search acceleration for data models, but the issue persists. The security team needs to run ad-hoc searches for threat hunting that cover multiple sourcetypes over the last 7 days. Additionally, the search head has a memory limit that is sometimes reached. The security team's searches are complex and involve joins and subsearches. The existing acceleration only covers a few data models. The team is looking for a quick win that does not require significant infrastructure changes. Which course of action would most effectively improve search performance without compromising data completeness?

Accepted Answer

Reduce the default time range to 'Last 7 days' and encourage users to specify shorter time ranges. Option B is correct because reducing the default time range from 'Last 30 days' to 'Last 7 days' directly reduces the data scanned by searches, which is the most effective quick win without infrastructure changes. Since the environment has high CPU usage on the search head and searches often time out, limiting the default time range reduces the load on the indexers and search head, improving performance for the majority of searches. This change does not compromise data completeness because users can still specify longer time ranges when needed.

Answer

Implement a data model for all sourcetypes and enforce using tstats for all searches

Answer

Increase the number of indexers to distribute the load

Answer

Use the search head clustering feature to distribute search load across multiple search heads

Question 6

A user wants to find the top 5 sourcetypes by event count over the last 24 hours. Which search is correct?

Accepted Answer

index=* | stats count by sourcetype | sort -count | head 5. Option B is correct because it uses stats to count events by sourcetype, sorts descending, and returns the top 5. Option A uses top but defaults to 10 results and does not specify a time range explicitly. Option C has invalid syntax (top 5 sourcetype). Option D uses eventcount which is not a valid command.

Answer

index=* | eventcount | top sourcetype

Answer

index=* | stats count by sourcetype | top 5 sourcetype

Answer

index=* | top sourcetype

Question 7

A Splunk admin notices that a search using the transaction command takes too long. To debug, they want to see how events are grouped into transactions before the transaction command runs. Which command can be added to the search pipeline before transaction to inspect the grouping?

Accepted Answer

streamstats. Option B is correct because streamstats can be used to compute a transaction ID based on a time window or field change, allowing you to see how events would be grouped. Options A, C, and D do not help inspect grouping.

Answer

map

Answer

fields

Answer

transaction

Question 8

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Accepted Answer

index=web | where response_time < 10000 | stats avg(response_time) by user. Option B is correct because it filters out outliers before computing the average per user. Option A filters after stats, so the average still includes outliers. Option C filters after stats as well, but tries to nullify the average, which is incorrect. Option D uses eventstats to compute overall average, then filters, then computes per-user average; this still includes outliers in the per-user average because the filter does not retroactively change the eventstats calculation.

Answer

index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

Answer

index=web | stats avg(response_time) by user | where response_time < 10000

Answer

index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

Question 9

To count events by host for the last hour, which search is most efficient?

Accepted Answer

index=* earliest=-1h | stats count by host. Option A is correct because it uses `index=*` to search all indexes and `earliest=-1h` to restrict the search to the last hour at the index level, which is the most efficient way to filter time. The `stats count by host` then aggregates counts per host without needing to process events outside the time range. This approach leverages Splunk's time-based index pruning, minimizing data scanned.

Answer

index=* | stats count by host | where _time > relative_time(now(), "-1h")

Answer

search index=* | head 1000 | stats count by host

Answer

sourcetype=access_combined | timechart count by host

Question 10

You need to find the percentage of total events contributed by each sourcetype. Which command should follow index=* | stats count by sourcetype?

Accepted Answer

eventstats sum(count) as total | eval percent = count/total*100. Option A is correct because eventstats adds a total count field across all events, then eval computes the percentage. Option B addtotals adds row totals, not a column total. Option C attempts to use sum in eval, which is invalid. Option D appendpipe adds a row with total, not a column, making the eval compute incorrectly.

Answer

addtotals

Answer

eval percent = count / sum(count) * 100

Answer

appendpipe [stats sum(count) as total] | eval percent = count/total*100

Question 11

A search includes a subsearch that returns 100,000 results, causing performance issues. Which optimization is best?

Accepted Answer

Use limit in the subsearch to return fewer results. Option A is correct because using the `limit` command in a subsearch restricts the number of results returned to the primary search, directly reducing the data volume that must be processed and joined. This is the most effective optimization when a subsearch returns a large result set (e.g., 100,000 events), as it minimizes memory and CPU overhead in the search head.

Answer

Use the fields command inside the subsearch

Answer

Use the format command inside the subsearch

Answer

Use the search command with index=* inside the subsearch

Question 12

To find users who logged in from more than 3 different IP addresses, which search is correct?

Accepted Answer

index=auth | stats dc(IP) by user | where dc(IP) > 3. Option A is correct because it uses `stats dc(IP) by user` to count distinct IP addresses per user, then filters with `where dc(IP) > 3` to return only users who logged in from more than 3 different IPs. The `dc()` function calculates distinct count, which is exactly what the question requires.

Answer

index=auth | top limit=3 IP by user

Answer

index=auth | eval user, IP | dedup user, IP | stats count by user | where count > 3

Answer

index=auth | stats distinct_count(IP) by user | where distinct_count(IP) > 3

Question 13

Which TWO of the following are valid ways to calculate the median of a numeric field?

Accepted Answer

eventstats median(field). Option B is correct because `eventstats median(field)` computes the median of the specified field and adds it as a new field to every event, which is a valid way to calculate the median. Option E is correct because `stats median(field)` directly computes the median of the numeric field and returns a single result, which is the standard method for median calculation in Splunk.

Answer

eval median = percentile(field, 50)

Answer

stats perc(field, 50)

Answer

stats p50(field)

Question 14

Which THREE of the following are valid ways to count the number of events per minute for a given sourcetype?

Accepted Answer

index=main sourcetype=web | eval minute = strftime(_time, "%Y-%m-%d %H:%M") | stats count by minute. Options A, B, and D are correct. A uses bucket to group by minute then stats count. B uses timechart with span=1m. D creates a minute-level string and groups by it. C uses date_minute which only captures the minute portion, not the full timestamp. E uses streamstats for a running count, not a per-minute count.

Answer

index=main sourcetype=web | stats count by date_minute

Answer

index=main sourcetype=web | streamstats count window=1m | where count>0

Question 15

Which TWO of the following commands can be used to find the most frequent value of a field within each group?

Accepted Answer

stats mode(field) by group. Option A is correct because `stats mode(field) by group` directly computes the most frequent value (mode) of the specified field for each group defined by the `by` clause. The `mode()` function is specifically designed to return the value that appears most often, making it the simplest and most accurate command for this task.

Answer

stats list(field) by group | eval top = mvindex('list', 0)

Answer

streamstats mode(field) by group

Answer

stats values(field) by group