SPLK-1002 Practice Test 25 — 15 Questions

Question 1

Refer to the exhibit. After running the search, the user wants to see only events where the HTTP status is 404. Which change to the search is correct?

Accepted Answer

Change the search to: index=main sourcetype=access_combined status=404 | stats count. Option B is correct because adding `status=404` directly in the base search filters events at the index level before any processing, which is the most efficient approach. The `stats count` command then aggregates the filtered results, ensuring only events with HTTP status 404 are included. This leverages Splunk's index-time filtering to reduce data volume early in the pipeline.

Answer

Add | where status=404 after the sort command.

Answer

Add | rename status as status_code and search for status_code=404.

Answer

Replace stats with top limit=1 status.

Question 2

A search uses `eval memory_MB = memory_bytes / 1024 / 1024`. The field memory_bytes contains values like '2,048,000'. The eval results memory_MB is often null. What is the most likely cause?

Accepted Answer

The field is actually a string with commas.. Option B is correct because the `memory_bytes` field contains values like '2,048,000', which include commas. In Splunk, fields with commas are treated as strings, not numeric values. When `eval` attempts arithmetic division on a string field, it returns null because the operation cannot be performed on non-numeric data. The commas must be removed (e.g., using `replace` or `tonumber`) before the field can be used in calculations.

Answer

The eval command has a syntax error.

Answer

The field needs to be converted first.

Answer

The division operator does not work on string fields.

Question 3

A team needs to calculate the average response time for each URL path from web server logs. The response time is in a field 'duration'. Which search is correct?

Accepted Answer

index=web | stats avg(duration) by url_path. Option D is correct because the `stats avg(duration) by url_path` command computes the average of the 'duration' field for each distinct value of 'url_path', exactly matching the requirement to calculate average response time per URL path. The `stats` command with a `by` clause groups results by the specified field and applies the aggregation function to each group.

Answer

index=web | timechart avg(duration) by url_path

Answer

index=web | chart avg(duration) by url_path

Answer

index=web | eval avg_duration=avg(duration) | stats by url_path

Question 4

Which THREE of the following are valid uses of the stats command?

Accepted Answer

stats avg(response_time) as avg_time. Option B is correct because the `stats` command supports aggregation functions like `avg()` to compute the average of a field, and the `as` clause renames the resulting field. This is a standard and valid use of `stats` for statistical summarization.

Answer

stats eval(x=1) by category

Answer

stats table user

Question 5

Which three of the following are valid ways to filter events before a transforming command? (Choose three.)

Accepted Answer

Use the `eval` command to set a field and then `where` before the transforming command.. Option A is correct because the `eval` command can create or modify fields, and the `where` command can then filter events based on those computed fields. Placing `where` before a transforming command (like `stats` or `timechart`) filters events before aggregation, which is essential for accurate results. This is a common pattern for conditional filtering in Splunk.

Answer

Use the `fields` command to remove unwanted fields.

Answer

Use the `where` command after the transforming command.

Question 6

Which TWO of the following commands will return exactly one result row when there is at least one event?

Accepted Answer

top limit=1 user. Option D is correct because `top limit=1 user` returns the single most frequent value of the `user` field, producing exactly one result row (the top user) when at least one event exists. Option E is correct because `stats count` without a `by` clause aggregates all events into a single row showing the total event count, always returning exactly one row as long as there is at least one event.

Answer

sort - count

Answer

chart count by user

Answer

eventstats count by user

Question 7

An analyst wants to find all events where the field 'status' is not 200. Which search is correct?

Accepted Answer

status!=200. Option C is correct because in SPL (Search Processing Language), the `!=` operator is used directly after the field name without a space to denote 'not equal to'. The syntax `status!=200` correctly filters events where the status field does not equal 200, and it is the standard way to express inequality in field-value comparisons.

Answer

status != 200

Answer

NOT status=200

Answer

status -neq 200

Question 8

A security analyst needs to find the number of failed login attempts per user in the last hour. The events contain a field 'result' with value 'failure'. Which search is correct?

Accepted Answer

index=security source=login result=failure | stats count by user. The `stats count by user` command correctly groups events by the `user` field and counts the number of events per user, which directly answers the question of failed login attempts per user. The search first filters events with `index=security`, `source=login`, and `result=failure`, then uses `stats` to aggregate the count per user. This is the most efficient and precise way to produce a table of user-to-failure-count mappings.

Answer

index=security source=login result=failure | top user

Answer

index=security source=login result=failure | timechart count by user

Answer

index=security source=login result=failure | chart count by user

Question 9

A user runs a search that returns thousands of results. They need to see only the first 100 events after sorting by time descending. Which command should they use?

Accepted Answer

sort - _time | head 100. The user needs the first 100 events after sorting by time descending. The `sort - _time` command sorts events in descending order by timestamp, and piping the result to `head 100` returns the first 100 events from that sorted list, which are the most recent 100 events. This is the correct approach because `head` returns events from the top of the result set, and sorting ensures the top events are the newest.

Answer

reverse

Answer

tail 100

Answer

head 100

Question 10

A search returns events with a field 'ip' that contains both IPv4 and IPv6 addresses. An analyst wants to count events for each IP type (IPv4 vs IPv6). Which command should be used to create a new field that categorizes the IP type?

Accepted Answer

eval. Option C is correct because the `eval` command can create a new field by evaluating an expression, such as using the `if` function with `like()` or `match()` to test whether the IP address contains a colon (IPv6) or a dot (IPv4). This allows the analyst to categorize each event's IP type into a new field like `ip_type` without altering the original data.

Answer

fields

Answer

convert

Answer

rex

Question 11

Refer to the exhibit. An analyst wants to see the top 10 most visited URI paths, but the result also includes a 'percent' column. To remove the percent column, which command should be added?

Accepted Answer

| fields - percent. The `fields` command with a minus sign removes specified fields from the results. Since the question asks to remove the 'percent' column, `| fields - percent` is the correct and most direct way to drop that field while keeping all other fields intact.

Answer

| table uri_path count

Answer

| eval percent=null()

Answer

| rename percent as ""

Question 12

Refer to the exhibit. A user runs this search. The results show only Error and Warning, but no Info. What is the most likely reason?

Accepted Answer

The stats command omitted the info severity because it has zero count.. The stats command with count() only returns results for field values that have at least one event. Since no events had severity=Info after the eval, Info has a count of zero and is omitted from the output. This is the expected behavior of stats — it does not include zero-count buckets unless explicitly requested with the `usenull=f` or similar options.

Answer

The eval command has a syntax error.

Answer

The sort command filters out Info.

Answer

The case statement does not evaluate to a string for Info.

Question 13

Refer to the exhibit. A user runs this search and gets 10 results as expected. However, they want to see the top 10 hosts for the past week. The search still returns results, but the counts are lower than expected. What is the most likely reason?

Accepted Answer

The time range is set to the past 24 hours by default.. By default, Splunk searches are restricted to the last 24 hours (unless a different time range is explicitly selected). Even though the user expects results for the past week, the search is only looking at the most recent 24 hours of data. This causes the counts to be lower than expected because events from earlier in the week are not included.

Answer

The sort command is not needed.

Answer

The head command restricts results.

Answer

The stats command counts all time.

Question 14

A user needs to see the trend of login failures over the past 7 days, broken down by hour. Which command should be used?

Accepted Answer

timechart count by _time. C is correct because `timechart count by _time` automatically creates a time-based chart with login failures aggregated per hour over the past 7 days. The `timechart` command splits the time range into equal-span buckets (default 1 hour for a 7-day window) and counts events in each bucket, displaying the trend over time. The `by _time` clause is redundant but not harmful; the command inherently uses `_time` as the x-axis.

Answer

stats count by _time

Answer

eval count

Answer

chart count over _time

Question 15

An analyst runs: index=app sourcetype=log ERROR | stats count by host | where count > 5. What is the function of the where command in this search?

Accepted Answer

Filter the output of stats to show only hosts with count > 5. The `where` command filters the results of the `stats` calculation, keeping only rows where the `count` field exceeds 5. This is a post-processing filter applied after aggregation, not a pre-filter on raw events. The `where` command operates on the output of `stats`, not on the original events.

Answer

Remove duplicate hosts

Answer

Filter events that contain ERROR before counting

Answer

Rename the count field

SPLK-1002 Practice Test 25 — 15 Questions

Exhibit

SPLK-1002 Practice Test 25 — 15 Questions

Exhibit