SPLK-1001 Basic Searching and Transforming Commands — 100 Questions

Question 1

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

Accepted Answer

| stats count by status | where count > 100. It uses `stats count by status` to count events per status code, creating a field named 'count', then filters with `where count > 100`. Option C is also correct, achieving the same result by renaming the count field to 'cnt' before filtering. Both follow the standard Splunk pipeline pattern of aggregating then filtering. Options B and D are incorrect: B uses an unnecessary `eval` and `sum(count)` which is inefficient; D places `where count > 100` before `stats`, so `count` does not exist yet, causing an error or no filtering.

Answer

| eval count=1 | stats sum(count) by status | where count > 100

Answer

| where count > 100 | stats count by status

Question 2

An analyst wants to remove duplicate events based on the 'user' field, keeping only the first occurrence. Which command should be used?

Accepted Answer

| dedup user. The `dedup` command in Splunk removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the analyst wants to remove duplicates based on the 'user' field and retain the first event, `| dedup user` is the correct command.

Answer

| sort -user

Answer

| uniq user

Answer

| fields user

Question 3

How many events will be output by this search?

Accepted Answer

3. The total number of events before the dedup command (not shown) is 15, but dedup on a field with only 3 unique values reduces the output to 3 events.

Answer

15

Answer

5

Answer

1

Question 4

What is the purpose of this search?

`index=web | top limit=5 status`

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The stem does not include the search query, but based on the options, the correct answer is C because it is the only option that describes a valid outcome of a search using the `top` command to find the most common HTTP status codes. Options A, B, and D are incorrect as they describe sorting or filtering behaviors that are not standard for a single search without additional commands.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 5

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. It filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 6

Which three of the following are valid uses of the `stats` command in Splunk? (Choose three.)

Accepted Answer

Counting the number of events by a specific field using `count(field)`. The `stats` command in Splunk is used to perform statistical aggregations on search results. `count(field)` counts the number of events where the specified field exists, `avg(field)` calculates the mean of a numeric field, and `earliest(field)` returns the earliest (oldest) timestamp value for that field within each group. These are all valid aggregation functions that operate on field values across events.

Answer

Sorting results in descending order directly within the stats command

Answer

Removing duplicate events based on a field using `dedup` inside the stats command

Answer

Joining two separate searches into a single stats output

Question 7

Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)

Accepted Answer

It can combine string values using the `+` operator. The `eval` command in Splunk is used to create new fields by evaluating expressions. It supports conditional logic with the `if` function (true for C). It can evaluate mathematical expressions like `eval x = y + 1` (true for F). However, it does not rename fields (B), modify raw indexed data (D), or combine strings using the `+` operator; string concatenation in Splunk eval uses the `.` operator or `concat` function (E is false).

Answer

It can be used to calculate mathematical expressions like `eval x = y + 1`

Answer

It can be used to rename fields in the search results

Answer

It modifies the original raw data stored in the index

Question 8

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `top` command automatically removes events with null or empty values for the specified field from the count.. The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. Importantly, by default, `top` and `rare` include events with null or empty values for the specified field as a separate value, rather than removing them automatically. Therefore, statement D is incorrect. Statements E and F are also false: `rare` can be used on any field, not just regex-extracted; and both commands have default limits (10 results) so the `limit` argument is optional.

Answer

Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Answer

The `rare` command can only be used on fields that have been extracted using regex.

Question 9

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Accepted Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.. Forwarder setup requires installation, configuration of output and input settings, restart, and verification.

Answer

Install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then verify that data is being forwarded to the indexer.

Answer

Configure outputs.conf to point to the indexer, then install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Question 10

Match each Splunk role to its typical permission scope.

Accepted Answer

User: Can search and create reports, but cannot modify system settings.. In Splunk, the User role has basic search and reporting capabilities without system changes, Power User adds knowledge object creation, and Admin has full system and user management access.

Answer

User: Can manage user accounts.

Answer

Power User: Has full access to system configuration.

Answer

Admin: Can search and create reports but cannot modify system settings.

Question 11

Match each Splunk license type to its description.

Accepted Answer

Splunk Enterprise: Full-featured, licensed by daily indexing volume, includes search and alerting.. Splunk Enterprise provides full features with paid licensing based on daily index volume; Splunk Free is limited to 500 MB/day without authentication; Splunk Forwarder only forwards data; Splunk Cloud is a managed SaaS. Common confusions include mixing Enterprise and Free or Forwarder and Enterprise.

Answer

Splunk Enterprise: Forwards data to other Splunk instances; does not index or search locally.

Answer

Splunk Free: Full-featured, licensed by daily indexing volume, includes search and alerting.

Question 12

An analyst wants to find all events where the field 'status' is not 200. Which search is correct?

Accepted Answer

status != 200. All three options A, B, and C are valid searches to find events where the status field is not 200. In SPL, the `!=` operator can be written with or without spaces (options A and C), and the `NOT` keyword can be used to negate a condition (option B). Option D uses an invalid operator `-neq`, which is not recognized in Splunk SPL.

Answer

status -neq 200

Question 13

A user runs a search that returns thousands of results. They need to see only the first 100 events after sorting by time descending. Which command should they use?

Accepted Answer

sort - _time | head 100. The user needs the first 100 events after sorting by time descending. The `sort - _time` command sorts events in descending order by timestamp, and piping the result to `head 100` returns the first 100 events from that sorted list, which are the most recent 100 events. This is the correct approach because `head` returns events from the top of the result set, and sorting ensures the top events are the newest.

Answer

reverse

Answer

tail 100

Answer

head 100

Question 14

Which TWO of the following commands can be used to create a new field from existing fields?

Accepted Answer

rex. The rex command (option A) is correct because it extracts new fields from existing fields at search time using regular expressions, creating named fields via the max_match and mode settings. The eval command (option B) is correct because it calculates and creates new fields from expressions that reference existing fields, such as eval total=price*quantity. The table command (option C) is incorrect because it only displays existing fields in a tabular format and does not create new ones. The convert command (option D) is incorrect because it transforms existing field values (for example, converting timestamps or units) rather than creating new fields from existing fields. The fields command (option E) is incorrect because it merely includes or excludes existing fields from results without generating new fields.

Answer

table

Answer

convert

Answer

fields

Question 15

Which TWO of the following commands will return exactly one result row when there is at least one event?

Accepted Answer

top limit=1 user. Option E, `stats count`, is correct because it aggregates the entire result set into a single summary row containing the total number of events, so it returns exactly one row whenever at least one event exists. Option D, `top limit=1 user`, is correct because the `top` command returns the most common values of a field, and with `limit=1` it returns only the single highest-frequency user, yielding exactly one result row when events are present. Option A, `sort - count`, is not a valid aggregation and would sort by a field named count without collapsing events into one row. Option B, `chart count by user`, produces one row per distinct user value, so it can return many rows. Option C, `eventstats count by user`, adds an aggregate field to each event rather than reducing the result set, so it also returns multiple rows.

Answer

sort - count

Answer

chart count by user

Answer

eventstats count by user

Question 16

Refer to the exhibit. A user runs this search. The results show only Error and Warning, but no Info. What is the most likely reason?

Accepted Answer

The stats command omitted the info severity because it has zero count.. The stats command with count() only returns results for field values that have at least one event. Since no events had severity=Info after the eval, Info has a count of zero and is omitted from the output. This is the expected behavior of stats — it does not include zero-count buckets unless explicitly requested with the `usenull=f` or similar options.

Answer

The eval command has a syntax error.

Answer

The sort command filters out Info.

Answer

The case statement does not evaluate to a string for Info.

Question 17

Refer to the exhibit. A user runs this search and gets 10 results as expected. However, they want to see the top 10 hosts for the past week. The search still returns results, but the counts are lower than expected. What is the most likely reason?

Accepted Answer

The time range is set to the past 24 hours by default.. By default, Splunk searches are restricted to the last 24 hours (unless a different time range is explicitly selected). Even though the user expects results for the past week, the search is only looking at the most recent 24 hours of data. This causes the counts to be lower than expected because events from earlier in the week are not included.

Answer

The sort command is not needed.

Answer

The head command restricts results.

Answer

The stats command counts all time.

Question 18

Refer to the exhibit. The search runs but the user field is not modified. What is the most likely cause?

Accepted Answer

The function name is misspelled (should be lower).. The `lower()` function in Splunk's `eval` command is case-sensitive and must be written in lowercase. The exhibit shows `Lower(user)` with a capital 'L', which Splunk does not recognize as a valid function, so the `eval` command fails silently and the `user` field remains unmodified.

Answer

The eval command does not modify existing fields.

Answer

The search must be run over a time range.

Answer

The field must be referenced as 'user'.

Question 19

A security analyst needs to find the number of failed login attempts per user in the last hour. The events contain a field 'result' with value 'failure'. Which search is correct?

Accepted Answer

index=security source=login result=failure | stats count by user. The `stats count by user` command correctly groups events by the `user` field and counts the number of events per user, which directly answers the question of failed login attempts per user. The search first filters events with `index=security`, `source=login`, and `result=failure`, then uses `stats` to aggregate the count per user. This is the most efficient and precise way to produce a table of user-to-failure-count mappings.

Answer

index=security source=login result=failure | top user

Answer

index=security source=login result=failure | timechart count by user

Answer

index=security source=login result=failure | chart count by user

Question 20

A search `index=main | top limit=10 user | fields - percent` is running slowly on a large dataset. Which change would likely improve performance the most?

Accepted Answer

Use stats count by user instead of top. The `top` command is a transforming command that internally performs a `sort` and `limit` after counting events. On large datasets, `top` can be slower than `stats count by user` because `top` includes additional overhead for calculating percentages and sorting all results before limiting. Using `stats count by user` followed by `sort 10 -count` achieves the same result with less processing overhead, as `stats` is more efficient for simple aggregation.

Answer

Add a rex command before top

Answer

Remove the fields command

Answer

Add a time range early in the search