SPLK-1001 Practice Test 20 — 15 Questions

Question 1

A security analyst needs to create a report that shows the average response time for each HTTP method (GET, POST, etc.) over the last 24 hours. The data is in the 'web' index with fields 'method' and 'response_time'. The analyst wants the results sorted with the highest average response time first. Which search should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=web earliest=-24h | stats avg(response_time) as avg_rt by method | sort - avg_rt. To calculate the average response time per HTTP method and sort descending, use stats avg() with a by clause to group by method, rename the result for clarity, and then sort with a '-' prefix to order from highest to lowest. The other options either sort ascending, use a command that produces a different structure, or reference a non-existent field.

Answer

index=web earliest=-24h | chart avg(response_time) over method | sort - avg_rt

Answer

index=web earliest=-24h | stats avg(response_time) as avg_rt by method | sort avg_rt

Answer

index=web earliest=-24h | timechart avg(response_time) by method | sort - avg_rt

Question 2

An analyst needs to display the top 5 values of the 'action' field from a set of web proxy events, along with the count and percentage for each value. The events are already retrieved by a base search. Which command should be added to the search to achieve this?

Accepted Answer

top limit=5 action. The top command is specifically designed to return the most common values of a field along with their count and percentage. Using limit=5 restricts the output to the top 5 values. The other commands either do not limit to top values, return the least common values, or do not aggregate by the field to produce counts and percentages.

Answer

rare limit=5 action

Answer

sort - count | head 5

Answer

stats count by action

Question 3

A security analyst needs to quickly see which five source IP addresses generated the most failed login events over the past 24 hours. The analyst wants a table that shows each source IP and its count, sorted with the highest count first. Which SPL search accomplishes this?

Accepted Answer

index=security action=failure | top limit=5 src_ip. The top command is the correct tool because it is a transforming command that aggregates events by a field and returns the most frequent values with counts, already sorted from highest to lowest. Adding limit=5 caps the result at the five most common source IP addresses, giving the analyst an immediate ranked view of the busiest failed-login origins.

Answer

index=security action=failure | stats count by src_ip | head 5

Answer

index=security action=failure | sort - count | table src_ip count

Answer

index=security action=failure | rare src_ip

Question 4

A SOC analyst searches web logs and gets a count for every status code, including rare ones like 418 and 000. The analyst wants to display only the three most frequently occurring status codes. Which search accomplishes this?

Accepted Answer

index=web | top limit=3 status. The top command is purpose-built to rank a field by frequency and limit the output, so top limit=3 status returns the three most common status codes with their counts and percentages. Approaches that aggregate first and then limit rows depend on ordering that is not guaranteed, and they can display arbitrary values instead of the genuinely most frequent ones.

Answer

index=web | stats count by status | top 3 status

Answer

index=web | stats count by status | sort count | tail 3

Answer

index=web | stats count by status | head 3

Question 5

A SOC analyst needs to quickly view the 15 slowest web transactions from the last hour in the 'web' index. The events already contain a numeric field named 'response_ms'. Which SPL search returns exactly the 15 events with the highest 'response_ms' values, sorted from slowest to fastest?

Accepted Answer

index=web earliest=-1h | sort - response_ms | head 15. To retrieve the slowest transactions, the events must first be ordered by the response_ms field in descending order and then truncated to the desired count. The minus sign reverses the default ascending sort, and head keeps only the first rows of that ordered stream. Aggregating commands such as top answer a different question because they count occurrences rather than rank numeric magnitude.

Answer

index=web earliest=-1h | sort response_ms | head 15

Answer

index=web earliest=-1h | head 15 | sort - response_ms

Answer

index=web earliest=-1h | top response_ms limit=15

Question 6

A Splunk administrator is troubleshooting authentication failures in the 'auth' index. The events contain a field named 'action' with values such as 'success', 'failure', and 'logout'. The administrator wants a single result row showing the total number of events for each distinct value of 'action'. Which SPL search produces that output?

Accepted Answer

index=auth | stats count by action. Grouped totals in Splunk are produced with a transforming command that accepts a by clause. Using stats with the count function and grouping by the action field collapses the event stream into one row per distinct action value, which directly answers how many successes, failures, and logouts occurred. Commands that merely filter, deduplicate, or display fields cannot create new aggregate values.

Answer

index=auth | table action count

Answer

index=auth | fields action | count

Answer

index=auth | dedup action

Question 7

A Splunk user runs a search that returns a large number of events. The user wants to display only the first 20 events sorted by the 'response_time' field in ascending order, and then show only the 'uri' and 'response_time' fields. Which sequence of SPL commands will accomplish this?

Accepted Answer

sort +response_time | head 20 | table uri, response_time. The correct sequence is to sort the full result set first, then limit to the first 20 events, and finally select the desired fields with table. Sorting before head ensures that the top 20 events are the ones with the lowest response times. Using head before sort would only sort a subset, which is not what the user wants.

Answer

sort -response_time | head 20 | table uri, response_time

Answer

head 20 | sort +response_time | table uri, response_time

Answer

table uri, response_time | sort +response_time | head 20

Question 8

An analyst has a base search that returns many events and wants the output sorted by the response_time field, largest value first, before reviewing the slowest requests. Which search returns the results in that order?

Accepted Answer

index=web | sort -response_time. Sorting results by a numeric field in descending order requires the sort command with a minus sign directly prefixed to the field name. That returns the largest response times first, which is what the analyst needs. Ascending sort, a space between the minus and the field, or the reverse command all fail to produce the required descending ranking by response_time.

Answer

index=web | reverse response_time

Answer

index=web | sort response_time

Answer

index=web | sort - response_time

Question 9

A Splunk administrator is building a dashboard panel and wants to display only the 20 most recent events from the index=web sourcetype=access_combined, with the newest event at the top of the panel. Which search accomplishes this?

Accepted Answer

index=web sourcetype=access_combined | sort - _time | head 20. Displaying the most recent events requires ordering by the _time field in descending order before limiting the result set. The sort - _time command places the newest events at the top, and head 20 then returns exactly 20 rows from that ordered set. Reversing the order of sort and head, or sorting ascending, produces the wrong events or the wrong sequence.

Answer

index=web sourcetype=access_combined | head 20 | sort - _time

Answer

index=web sourcetype=access_combined | sort _time | head 20

Answer

index=web sourcetype=access_combined | top limit=20 _time

Question 10

An analyst needs to compare the total number of successful and failed login events for each user over the last 7 days, and wants a single row per user with two separate columns: one for successes and one for failures. Which SPL search produces this output?

Accepted Answer

index=auth | stats count(eval(action="success")) as successes count(eval(action="failure")) as failures by user. Conditional counting with stats and the eval function is the standard way to produce multiple named count columns in one row per group. Grouping by user while computing count(eval(action="success")) and count(eval(action="failure")) yields a successes column and a failures column per user, giving the exact side-by-side comparison the analyst requested.

Answer

index=auth | chart count over user by action

Answer

index=auth | stats count by user action

Answer

index=auth | timechart span=7d count by action

Question 11

A threat hunter needs to count events in the 'firewall' index grouped by both the 'src' and 'dest' fields, and then display only the combinations that occurred more than 100 times. Which SPL search accomplishes this?

Accepted Answer

index=firewall | stats count by src dest | where count > 100. Filtering on an aggregated value requires a two-stage pipeline: first compute the aggregate with a transforming command, then apply a condition to the resulting field. The stats command creates the count field grouped by source and destination, and the where command evaluates that calculated field against the numeric threshold. Row-limiting commands such as head cannot express a value-based condition.

Answer

index=firewall | stats count by src dest | head 100

Answer

index=firewall | stats count by src dest | search count > 100

Answer

index=firewall count > 100 | stats count by src dest

Question 12

An analyst runs a search that returns thousands of events with a field named 'action'. They want to see only the count of each unique action value, sorted from highest to lowest count. Which SPL search achieves this?

Accepted Answer

index=web | top action. The top command is designed to return the most common values of a field along with their frequency and percentage, automatically sorted in descending order. Using top action directly produces the count of each unique action value sorted from highest to lowest. While stats count by action would also work, it is not among the options; stats count(action) without a by clause only returns a single total.

Answer

index=web | stats sum(action)

Answer

index=web | sort - action

Answer

index=web | stats count(action)

Question 13

A Splunk user wants to calculate the average response time for each HTTP status code from a web server log. The events contain fields 'status' and 'response_time'. Which search will produce a table with each status code and its average response time?

Accepted Answer

index=web | stats avg(response_time) by status. The stats command with the avg function and a by clause groups events by the specified field and calculates the average of the numeric field for each group. This produces a table with one row per status code and the average response time, which is the desired output. The other options either produce a chart, include a time dimension, or calculate the wrong statistic.

Answer

index=web | chart avg(response_time) over status

Answer

index=web | timechart avg(response_time) by status

Answer

index=web | stats sum(response_time) by status

Question 14

A security analyst wants to find the number of failed login attempts per user, but only for users who have more than 5 failures. Which SPL search is correct?

Accepted Answer

index=security action=failure | stats count by user | where count > 5. After aggregating with stats, you must use the where command to filter on the calculated count field. The where command evaluates arbitrary expressions, including numeric comparisons, on fields in the result set. Placing where after stats ensures the count field is available. Using search after stats does not work for numeric comparisons on aggregated fields, and placing where before stats fails because count does not exist yet.

Answer

index=security action=failure | stats count by user | filter count > 5

Answer

index=security action=failure | stats count by user | search count > 5

Answer

index=security action=failure | where count > 5 | stats count by user

Question 15

A network analyst needs to find the average response time per host for events in the last hour, and then display only the hosts whose average exceeds 500 milliseconds. Which SPL search accomplishes this?

Accepted Answer

index=network earliest=-1h | stats avg(response_time) as avg_rt by host | where avg_rt > 500. Aggregating first and filtering second is the correct order. The stats command computes an average response time per host and names it avg_rt, and the where command then applies the numeric threshold to that calculated field. Filtering before aggregation or referencing the original response_time field after aggregation cannot produce the desired hosts.

Answer

index=network earliest=-1h | where avg(response_time) > 500 | stats avg(response_time) by host

Answer

index=network earliest=-1h | stats avg(response_time) by host | where response_time > 500

Answer

index=network earliest=-1h | stats avg(response_time) as avg_rt by host | search avg_rt > 500