SPLK-1003 Advanced Searching and Statistics — Timed 20 Questions

Question 1

A security analyst needs to find all events where the field 'user' has a value that is either 'admin' or 'root', but the search is returning too many results from a noisy source. Which search best filters the events to only include those where the 'user' field exactly matches 'admin' or 'root'?

Accepted Answer

user IN ("admin", "root"). Option C is correct because the `IN` operator in Splunk's Search Processing Language (SPL) performs an exact match against a list of values, ensuring that only events where the `user` field is exactly 'admin' or 'root' are returned. This is the most precise and efficient way to filter for multiple exact values without introducing wildcard behavior or relying on implicit field-value parsing that may include surrounding whitespace or punctuation.

Answer

user="admin" OR user="root"

Answer

user=*admin* OR user=*root*

Answer

user=admin OR user=root

Question 2

A Splunk administrator runs the following search and notices that the results include events where the 'status' field is 200 or 404, but also includes events where the 'status' field is missing. What is the most efficient way to modify the search to exclude events where the 'status' field does not exist?

Accepted Answer

NOT ISNULL(status) (status=200 OR status=404). Option B is correct because it uses the `NOT ISNULL(status)` filter before the OR conditions, which efficiently excludes events where the `status` field does not exist. In Splunk, `ISNULL()` returns true if a field is missing or null, so `NOT ISNULL(status)` ensures only events with a defined `status` field are considered, and then the parentheses group the OR conditions correctly. This approach is more efficient than post-filtering because it reduces the result set early in the search pipeline.

Answer

status=200 OR status=404 | search status!=null

Answer

status=200 OR status=404 | where isnotnull(status)

Answer

status=200 OR status=404

Question 3

An analyst wants to find the top 5 users who have the highest total bytes transferred. The data has fields 'user' and 'bytes'. Which search should be used?

Accepted Answer

| stats sum(bytes) as total_bytes by user | sort - total_bytes | head 5. Option B is correct because it uses `stats sum(bytes) as total_bytes by user` to aggregate the total bytes transferred per user, then sorts the results in descending order with `sort - total_bytes`, and finally limits the output to the top 5 users with `head 5`. This directly answers the requirement for the highest total bytes transferred.

Answer

| stats max(bytes) as max_bytes by user | sort - max_bytes | head 5

Answer

| sort - bytes | head 5 | table user, bytes

Answer

| top limit=5 user

Question 4

A search returns events with a field 'response_time' in milliseconds. The analyst wants to categorize response times into three buckets: 'fast' (< 100), 'medium' (100-500), 'slow' (> 500). Which search correctly creates this categorization?

Accepted Answer

| eval bucket=case(response_time<100,"fast", response_time>=100 AND response_time<=500,"medium", response_time>500,"slow"). Option A is correct because it uses the `case` function to evaluate multiple conditions in order, assigning 'fast' for response_time < 100, 'medium' for values between 100 and 500 inclusive, and 'slow' for values > 500. The `case` function returns the result of the first true condition, making it ideal for mutually exclusive buckets without overlapping logic.

Answer

| eval bucket=if(response_time<100,"fast",response_time<500,"medium","slow")

Answer

| eval bucket=if(response_time<100,"fast",if(response_time<=500,"medium","slow"))

Answer

| where response_time<100 | eval bucket="fast" | append [search where response_time>=100 AND response_time<=500 | eval bucket="medium"]

Question 5

A search uses 'transaction' to group events by session, but the results show too many transactions with only one event. What is the best way to filter out single-event transactions?

Accepted Answer

| transaction ... | where eventcount > 1. Option A is correct because the `transaction` command groups events into transactions, and appending `| where eventcount > 1` filters out any transaction that consists of only a single event. This directly addresses the requirement to remove single-event transactions, as `eventcount` is a default field added by `transaction` that counts the number of events in each transaction.

Answer

Add maxspan=5m to the transaction command

Answer

| transaction maxevents=2 ...

Answer

| transaction ... | where eventcount=2

Question 6

Which TWO of the following statements about the 'stats' command are true?

Accepted Answer

It can be used with a BY clause to group results.. Option A is correct because the 'stats' command in Splunk supports a BY clause that allows you to group results by one or more fields, similar to a SQL GROUP BY. This enables you to compute aggregate statistics (e.g., count, sum, avg) for each distinct value of the specified field(s), which is a core feature for summarizing event data.

Answer

The count() function must always include a field argument.

Answer

It creates one event per input event by default.

Answer

It can be used to modify individual field values in raw events.

Question 7

Which THREE of the following are valid Splunk search commands for determining the number of distinct values of a field?

Accepted Answer

| stats dc(field). Option B is correct because `| stats dc(field)` uses the `dc` (distinct count) function to return the exact number of unique values for the specified field. This is the direct and most efficient command for counting distinct values in Splunk.

Answer

| stats count(field)

Answer

| stats distinct_count(field)

Question 8

The search returns zero results, but the lookup file contains users with names like 'admin1', 'admin2'. What is the most likely reason?

Accepted Answer

The 'like' function requires a wildcard pattern with '%' but the field value may have leading/trailing spaces or the pattern is case-sensitive.. The 'like' function in Splunk uses SQL-style pattern matching where '%' matches any sequence of characters. If the lookup file contains 'admin1' and 'admin2', but the search uses 'like(role, "admin%")', leading/trailing spaces in the field values or case sensitivity (e.g., 'Admin1' vs 'admin1') would cause the pattern to fail, returning zero results. Option B correctly identifies this as the most likely reason because Splunk's 'like' is case-sensitive by default and does not trim spaces.

Answer

The lookup file is not in CSV format.

Answer

The stats command only counts events where role=admin, but the role field is already filtered.

Answer

The search command runs before the eval command.

Question 9

The search returns unexpected results, including IP addresses that are not in the expected format (e.g., '127.0.0.1' appears as '27.0.0.1'). What is the most likely cause?

Accepted Answer

The rex command extracts the first match only; some events may have multiple IPs and the first one is not the full IP.. Option D is correct because the `rex` command, by default, extracts only the first match of a regex pattern from each event. If an event contains multiple IP addresses, `rex` captures the first occurrence, which may be truncated if the regex pattern is not anchored properly or if the IP appears in a context where leading digits are separated (e.g., '127.0.0.1' might be preceded by a character that causes the regex to match starting at '27.0.0.1'). This is a common behavior in Splunk when using `rex` without the `max_match` parameter.

Answer

The regex pattern is incorrect; it should use \b for word boundaries.

Answer

The top command is modifying the extracted ip field.

Answer

The rex command must be placed before the index search.

Question 10

A security analyst needs to find all events where the field `status` has a value of either "error" or "critical" and the field `bytes` is greater than 1000. Which search correctly accomplishes this?

Accepted Answer

(status=error OR status=critical) bytes>1000. Option A is correct because in Splunk's Search Processing Language (SPL), parentheses group the OR conditions to ensure they are evaluated together, and the space between the grouped condition and `bytes>1000` acts as an implicit AND. This correctly retrieves events where `status` is either "error" or "critical" AND `bytes` is greater than 1000.

Answer

status=error OR status=critical AND bytes>1000

Answer

status IN (error, critical) AND bytes>1000

Answer

status="error" OR status="critical" bytes>1000

Question 11

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. Option A is correct because it uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 12

A search returns many events, and the analyst wants to see a summary table of the top 5 values of the field `src_ip` along with the count of events for each. Which command should be used?

Accepted Answer

top. The `top` command in Splunk is specifically designed to find the most common values of a field and display them in a summary table with counts and percentages. By default, `top` returns the top 10 values, but you can use the `limit=5` parameter to restrict the output to the top 5 values of `src_ip` along with their event counts. This directly meets the analyst's requirement.

Answer

eventstats

Answer

sort

Answer

rare

Question 13

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. Option D is correct because `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 14

An analyst wants to create a timechart of the count of events per hour, but only for events where the field `status` contains the word "fail" (case-insensitive). Which search is correct?

Accepted Answer

index=main | timechart count by eval(case(match(status,"(?i)fail"),1)). Option D is correct because it uses `eval` with `case` and `match` to create a field that is 1 when `status` contains 'fail' (case-insensitive via `(?i)`), then uses `timechart count by` that field to count only matching events per hour. This approach correctly filters within the timechart aggregation, ensuring only events where status matches the pattern are counted.

Answer

index=main | timechart count | search status=*fail*

Answer

index=main | regex status="fail" | timechart count

Answer

index=main | where status="*fail*" | timechart count

Question 15

Which TWO of the following statements about the `transaction` command are true? (Choose two.)

Accepted Answer

The transaction command can group events that share a common field value, such as a session ID.. Option C is correct because the `transaction` command is designed to group events that share a common field value, such as a session ID, allowing you to correlate related events into a single transaction. This is a core use case for tracking user sessions or multi-step processes where events are linked by a shared identifier.

Answer

The transaction command can only be used on events that have a timestamp.

Answer

The transaction command uses a sliding time window to detect transaction boundaries.

Answer

The transaction command removes all fields except those specified in the `fields` argument.

Question 16

Which THREE of the following are valid ways to create a subsearch in SPL? (Choose three.)

Accepted Answer

... | map search="search index=other $field$". Option B is correct because the `map` command in SPL allows you to run a subsearch for each result of the outer search, using field values from the outer result (e.g., `$field$`) to dynamically construct the inner search. This is a valid way to create a subsearch that iterates over search results, making it a legitimate subsearch pattern in Splunk.

Answer

... | join type=inner [search index=other]

Answer

[return index=main | stats count]

Question 17

A security analyst wants to find all events where the field 'src_ip' matches any IP address in a lookup table named 'malicious_ips.csv'. The lookup has fields 'ip' and 'threat'. Which search correctly enriches events with the threat info and filters to only malicious IPs?

Accepted Answer

`index=security | lookup malicious_ips.csv src_ip AS ip OUTPUTNEW threat | where isnotnull(threat)`. Option E is correct because it uses the `lookup` command with `OUTPUTNEW threat` to add the threat field only for matching src_ip values, and then `where isnotnull(threat)` filters to events that actually matched, ensuring only events with a known malicious IP are retained. The `OUTPUTNEW` clause is critical here as it only populates the threat field when a match occurs, unlike `OUTPUT` which would overwrite existing values.

Answer

`index=security | lookup malicious_ips.csv src_ip | search threat=*`

Answer

`index=security | lookup malicious_ips.csv src_ip OUTPUT threat | where threat!=""`

Answer

`index=security [| inputlookup malicious_ips.csv | fields ip | rename ip as src_ip]`

Answer

`index=security | lookup malicious_ips.csv src_ip AS ip | where isnotnull(threat)`

Question 18

A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?

Accepted Answer

`... | timechart span=1h dc(user)`. Option C is correct because `timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.

Answer

`... | stats dc(user) by _time span=1h`

Answer

`... | timechart span=1h dc(by user)`

Answer

`... | eval user=user | timechart span=1h count by user`

Answer

`... | timechart span=1h sum(count) by user`

Question 19

An analyst runs `index=web status=500 | top 10 uri` and gets results. Which statement is true about the 'top' command's behavior?

Accepted Answer

It counts the number of events per URI and displays the 10 with the highest count.. The `top` command in Splunk counts the occurrences of each distinct value of a specified field (here, `uri`) and returns the values with the highest counts. By default, it returns the top 10 results, so option E correctly describes that it counts events per URI and displays the 10 with the highest count.

Answer

It returns the 10 URIs that appeared most recently.

Answer

It computes the average latency per URI and shows the top 10.

Answer

It sums a numeric field per URI and shows the top 10 sums.

Answer

It requires a 'by' clause to specify the field to group by.

Question 20

A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which search is correct?

Accepted Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`. Option C is correct because it uses the `stats` command to compute the average duration and count per user in a single pass, then filters with `where` to enforce both conditions: average duration > 100 and event count > 5. This is the standard pattern for per-user aggregation followed by post-aggregation filtering in Splunk.

Answer

`... | where avg(duration)>100 | stats count by user | where count>5`

Answer

`... | top user limit=0 | where avg(duration)>100`

Answer

`... | eventstats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`

Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | having avg_dur>100 and cnt>5`