SPLK-1001 Basic Searching and Transforming Commands — 20 Questions

Question 1

How many events will be output by this search?

Accepted Answer

3. The total number of events before the dedup command (not shown) is 15, but dedup on a field with only 3 unique values reduces the output to 3 events.

Answer

15

Answer

5

Answer

1

Question 2

Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)

Accepted Answer

It can be used to create new fields based on existing field values and functions. The `eval` command in Splunk is used to create new fields by evaluating expressions. It supports conditional logic with the `if` function (true for C). It can evaluate mathematical expressions like `eval x = y + 1` (true for F). However, it does not rename fields (B), modify raw indexed data (D), or combine strings using the `+` operator; string concatenation in Splunk eval uses the `.` operator or `concat` function (E is false).

Answer

It modifies the original raw data stored in the index

Answer

It can be used to calculate mathematical expressions like `eval x = y + 1`

Answer

It can be used to rename fields in the search results

Question 3

Refer to the exhibit. A security analyst runs this search and gets two rows: threat_level 'high' and 'low'. However, many events have threat_score between 60 and 90 that are not captured. How should the search be modified to include a 'medium' category?

Accepted Answer

Change the eval to a case statement with multiple conditions.. The existing `eval` command uses an `if` function, which only supports a single condition and a single else clause. To create three categories (high, medium, low), you need a `case` statement that evaluates multiple conditions in order, allowing you to assign 'medium' for threat_score between 60 and 90. The `case` function returns the value for the first true condition, making it ideal for multi-category classification.

Answer

Use the `fillnull` command to add missing values.

Answer

Use the `search` command to filter threat_score>90.

Answer

Add a third condition: if(threat_score > 60 AND threat_score <=90, "medium", ...) inside the existing eval.

Question 4

A user needs to see the trend of login failures over the past 7 days, broken down by hour. Which command should be used?

Accepted Answer

chart count over _time. D is correct because `chart count over _time` automatically creates a time-based chart with hourly buckets for a 7-day window, showing the trend of login failures. Options A and C produce counts per unique timestamp, not binned. B is not a transforming command.

Answer

stats count by _time

Answer

eval count

Answer

timechart count by _time

Question 5

A security analyst uses Splunk to ingest firewall logs from multiple locations. The index is 'firewall' and the sourcetype is 'fw_log'. Each event contains fields: src_ip, dest_ip, action, bytes, and time. The analyst needs to find how many unique source IPs have been logged in the last hour to report potential scanning activity. The search should be efficient and accurate, returning only the total count of distinct source IPs. Which search accomplishes this?

Accepted Answer

index=firewall sourcetype=fw_log earliest=-1h | stats dc(src_ip) as UniqueIPs. It uses the `stats dc(src_ip)` command, which directly calculates the distinct count of source IPs in a single, efficient pass over the data. The `earliest=-1h` time filter restricts the search to the last hour, and the `as UniqueIPs` alias provides the exact output requested: a single number representing the total count of unique source IPs.

Answer

index=firewall sourcetype=fw_log earliest=-1h | dedup src_ip | stats count as UniqueIPs

Answer

index=firewall sourcetype=fw_log earliest=-1h | top src_ip | stats count as UniqueIPs

Answer

index=firewall sourcetype=fw_log | timechart dc(src_ip) span=1h

Question 6

A security analyst needs to identify the top 5 source IP addresses generating the most web traffic. Which command should be used?

Accepted Answer

| top limit=5 src_ip. The `top` command is specifically designed to return the most common values of a field, and `limit=5` restricts the output to the top 5 source IP addresses by count. This command automatically sorts the results in descending order, making it the most efficient and direct way to identify the top 5 source IPs generating web traffic.

Answer

| stats count by src_ip | sort - count

Answer

| sort - count | head 5

Answer

| table src_ip | head 5

Question 7

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

Accepted Answer

| stats count by status | where count > 100. It uses `stats count by status` to count events per status code, creating a field named 'count', then filters with `where count > 100`. Option C is also correct, achieving the same result by renaming the count field to 'cnt' before filtering. Both follow the standard Splunk pipeline pattern of aggregating then filtering. Options B and D are incorrect: B uses an unnecessary `eval` and `sum(count)` which is inefficient; D places `where count > 100` before `stats`, so `count` does not exist yet, causing an error or no filtering.

Answer

| eval count=1 | stats sum(count) by status | where count > 100

Answer

| where count > 100 | stats count by status

Question 8

A search returns events with a field 'duration' in milliseconds. The analyst wants to create a new field 'duration_sec' that divides duration by 1000. Which command accomplishes this?

Accepted Answer

| eval duration_sec = duration / 1000. The `eval` command in Splunk is specifically designed to create new fields by evaluating expressions, including arithmetic operations. Using `| eval duration_sec = duration / 1000` creates a new field `duration_sec` that contains the value of `duration` divided by 1000, converting milliseconds to seconds.

Answer

| rename duration as duration_sec

Answer

| convert duration_sec = duration/1000

Answer

| fields duration_sec = duration/1000

Question 9

A search returns 1,000 events. The analyst wants to see the first 10 events sorted by the '_time' field in descending order. Which search is correct?

Accepted Answer

| sort -_time | head 10. The `sort` command with a hyphen prefix (`-`) sorts in descending order. By default, `sort` sorts in ascending order, so `sort -_time` sorts events by the `_time` field from newest to oldest, and `head 10` returns the first 10 events, which are the 10 most recent.

Answer

| sort by _time | head 10

Answer

| sort +_time | head 10

Answer

| sort _time | head 10

Question 10

An analyst wants to remove duplicate events based on the 'user' field, keeping only the first occurrence. Which command should be used?

Accepted Answer

| dedup user. The `dedup` command in Splunk removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the analyst wants to remove duplicates based on the 'user' field and retain the first event, `| dedup user` is the correct command.

Answer

| sort -user

Answer

| uniq user

Answer

| fields user

Question 11

A search includes the command '| stats dc(user) by host'. What does this command return?

Accepted Answer

The number of distinct users per host. The `dc(user)` function in the `stats` command calculates the distinct count of the `user` field values. When combined with `by host`, it returns the number of unique users for each host. This is why option D is correct.

Answer

The number of unique hosts per user

Answer

The count of events per host

Answer

The sum of user values per host

Question 12

Which TWO commands can be used to filter events based on a field value? (Choose two.)

Accepted Answer

search. The `search` command is the primary way to filter events in Splunk, and it can be used to filter based on field values using syntax like `field=value`. The `where` command evaluates Boolean expressions and is specifically designed to filter results based on field values, supporting comparisons, wildcards, and functions. Both commands directly filter events by evaluating field values.

Answer

eval

Answer

stats

Answer

table

Question 13

Which THREE of the following are valid uses of the 'eval' command? (Choose three.)

Accepted Answer

Concatenating two strings: eval fullname = firstname + " " + lastname. The 'eval' command can concatenate strings using the plus (+) operator, as shown in the example 'eval fullname = firstname + " " + lastname'. This creates a new field 'fullname' by combining the values of 'firstname', a space, and 'lastname'.

Answer

Grouping events by a field: eval by host

Answer

Sorting events by a field: eval sort by _time

Question 14

What is the purpose of this search?

`index=web | top limit=5 status`

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The stem does not include the search query, but based on the options, the correct answer is C because it is the only option that describes a valid outcome of a search using the `top` command to find the most common HTTP status codes. Options A, B, and D are incorrect as they describe sorting or filtering behaviors that are not standard for a single search without additional commands.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 15

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. It filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 16

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Accepted Answer

The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.. The `stats` command in Splunk is specifically designed to compute summary statistics like count, sum, avg, and distinct count over a set of events. It transforms raw event data into aggregated results, making it a core transforming command for reporting and analysis.

Answer

The `stats` command displays a list of individual events with their fields.

Answer

The `stats` command is used to create new fields using the `eval` function.

Answer

The `stats` command can only be used with numeric fields.

Question 17

Refer to the exhibit. A security analyst runs the search and sees the result table. The analyst wants to see only the top 3 URI paths with their counts, without the percentage column. Which command modification achieves this?

Accepted Answer

`index=web sourcetype=access_combined | top limit=3 showperc=f uri_path`. The `top` command's `showperc=f` argument suppresses the percentage column, and `limit=3` restricts the output to the top 3 URI paths. This directly meets the requirement of showing only the top 3 URI paths with their counts, without the percentage column.

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path | fields - percent`

Answer

`index=web sourcetype=access_combined | top uri_path | head 3`

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path`

Question 18

A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?

Accepted Answer

Rewrite the search as `index=main error | stats count by host`.. The original search uses a pipe to the `search` command, which forces Splunk to retrieve all events from the index and then filter them in the search head, causing unnecessary I/O and CPU load. By rewriting the search as `index=main error`, the keyword `error` becomes part of the initial search string, allowing Splunk to use its index-time and search-time optimizations (e.g., inverted index lookups, bloom filters) to retrieve only matching events from disk, dramatically reducing the data scanned and improving performance without altering results.

Answer

Use the `transaction` command to group related events before counting.

Answer

Replace `stats count by host` with `top limit=5 host` to limit output.

Answer

Add a `summarize` command before `stats` to pre-aggregate data.

Question 19

Which three of the following are valid uses of the `stats` command in Splunk? (Choose three.)

Accepted Answer

Calculating the average value of a numeric field using `avg(field)`. The `stats` command in Splunk is used to perform statistical aggregations on search results. `count(field)` counts the number of events where the specified field exists, `avg(field)` calculates the mean of a numeric field, and `earliest(field)` returns the earliest (oldest) timestamp value for that field within each group. These are all valid aggregation functions that operate on field values across events.

Answer

Sorting results in descending order directly within the stats command

Answer

Joining two separate searches into a single stats output

Answer

Removing duplicate events based on a field using `dedup` inside the stats command

Question 20

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `rare` command returns the least common values of a field based on count.. The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. Importantly, by default, `top` and `rare` include events with null or empty values for the specified field as a separate value, rather than removing them automatically. Therefore, statement D is incorrect. Statements E and F are also false: `rare` can be used on any field, not just regex-extracted; and both commands have default limits (10 results) so the `limit` argument is optional.

Answer

Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Answer

The `rare` command can only be used on fields that have been extracted using regex.