SPLK-1001 Basic Searching and Transforming Commands Practice Test 1 — 15 Questions

Question 1

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

Accepted Answer

| stats count by status | where count > 100. It uses `stats count by status` to count events per status code, creating a field named 'count', then filters with `where count > 100`. Option C is also correct, achieving the same result by renaming the count field to 'cnt' before filtering. Both follow the standard Splunk pipeline pattern of aggregating then filtering. Options B and D are incorrect: B uses an unnecessary `eval` and `sum(count)` which is inefficient; D places `where count > 100` before `stats`, so `count` does not exist yet, causing an error or no filtering.

Answer

| eval count=1 | stats sum(count) by status | where count > 100

Answer

| where count > 100 | stats count by status

Question 2

An analyst wants to remove duplicate events based on the 'user' field, keeping only the first occurrence. Which command should be used?

Accepted Answer

| dedup user. The `dedup` command in Splunk removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the analyst wants to remove duplicates based on the 'user' field and retain the first event, `| dedup user` is the correct command.

Answer

| sort -user

Answer

| uniq user

Answer

| fields user

Question 3

How many events will be output by this search?

Accepted Answer

3. The total number of events before the dedup command (not shown) is 15, but dedup on a field with only 3 unique values reduces the output to 3 events.

Answer

15

Answer

5

Answer

1

Question 4

What is the purpose of this search?

`index=web | top limit=5 status`

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The stem does not include the search query, but based on the options, the correct answer is C because it is the only option that describes a valid outcome of a search using the `top` command to find the most common HTTP status codes. Options A, B, and D are incorrect as they describe sorting or filtering behaviors that are not standard for a single search without additional commands.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 5

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. It filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 6

Which three of the following are valid uses of the `stats` command in Splunk? (Choose three.)

Accepted Answer

Finding the earliest timestamp of events grouped by a field using `earliest(field)`. The `stats` command in Splunk is used to perform statistical aggregations on search results. `count(field)` counts the number of events where the specified field exists, `avg(field)` calculates the mean of a numeric field, and `earliest(field)` returns the earliest (oldest) timestamp value for that field within each group. These are all valid aggregation functions that operate on field values across events.

Answer

Sorting results in descending order directly within the stats command

Answer

Joining two separate searches into a single stats output

Answer

Removing duplicate events based on a field using `dedup` inside the stats command

Question 7

Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)

Accepted Answer

It can be used to create new fields based on existing field values and functions. The `eval` command in Splunk is used to create new fields by evaluating expressions. It supports conditional logic with the `if` function (true for C). It can evaluate mathematical expressions like `eval x = y + 1` (true for F). However, it does not rename fields (B), modify raw indexed data (D), or combine strings using the `+` operator; string concatenation in Splunk eval uses the `.` operator or `concat` function (E is false).

Answer

It can be used to rename fields in the search results

Answer

It modifies the original raw data stored in the index

Answer

It can be used to calculate mathematical expressions like `eval x = y + 1`

Question 8

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `top` command returns the most common values of a field based on count.. The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. Importantly, by default, `top` and `rare` include events with null or empty values for the specified field as a separate value, rather than removing them automatically. Therefore, statement D is incorrect. Statements E and F are also false: `rare` can be used on any field, not just regex-extracted; and both commands have default limits (10 results) so the `limit` argument is optional.

Answer

The `rare` command can only be used on fields that have been extracted using regex.

Answer

Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Question 9

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Accepted Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.. Forwarder setup requires installation, configuration of output and input settings, restart, and verification.

Answer

Install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then verify that data is being forwarded to the indexer.

Answer

Configure outputs.conf to point to the indexer, then install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Question 10

Match each Splunk role to its typical permission scope.

Accepted Answer

User: Can search and create reports, but cannot modify system settings.. In Splunk, the User role has basic search and reporting capabilities without system changes, Power User adds knowledge object creation, and Admin has full system and user management access.

Answer

User: Can manage user accounts.

Answer

Power User: Has full access to system configuration.

Answer

Admin: Can search and create reports but cannot modify system settings.

Question 11

Match each Splunk license type to its description.

Accepted Answer

Splunk Enterprise: Full-featured, licensed by daily indexing volume, includes search and alerting.. Splunk Enterprise provides full features with paid licensing based on daily index volume; Splunk Free is limited to 500 MB/day without authentication; Splunk Forwarder only forwards data; Splunk Cloud is a managed SaaS. Common confusions include mixing Enterprise and Free or Forwarder and Enterprise.

Answer

Splunk Enterprise: Forwards data to other Splunk instances; does not index or search locally.

Answer

Splunk Free: Full-featured, licensed by daily indexing volume, includes search and alerting.

Question 12

An analyst wants to find all events where the field 'status' is not 200. Which search is correct?

Accepted Answer

status != 200. All three options A, B, and C are valid searches to find events where the status field is not 200. In SPL, the `!=` operator can be written with or without spaces (options A and C), and the `NOT` keyword can be used to negate a condition (option B). Option D uses an invalid operator `-neq`, which is not recognized in Splunk SPL.

Answer

status -neq 200

Question 13

A user runs a search that returns thousands of results. They need to see only the first 100 events after sorting by time descending. Which command should they use?

Accepted Answer

sort - _time | head 100. The user needs the first 100 events after sorting by time descending. The `sort - _time` command sorts events in descending order by timestamp, and piping the result to `head 100` returns the first 100 events from that sorted list, which are the most recent 100 events. This is the correct approach because `head` returns events from the top of the result set, and sorting ensures the top events are the newest.

Answer

reverse

Answer

tail 100

Answer

head 100

Question 14

Which TWO of the following commands can be used to create a new field from existing fields?

Accepted Answer

rex. The rex command (option A) is correct because it extracts new fields from existing fields at search time using regular expressions, creating named fields via the max_match and mode settings. The eval command (option B) is correct because it calculates and creates new fields from expressions that reference existing fields, such as eval total=price*quantity. The table command (option C) is incorrect because it only displays existing fields in a tabular format and does not create new ones. The convert command (option D) is incorrect because it transforms existing field values (for example, converting timestamps or units) rather than creating new fields from existing fields. The fields command (option E) is incorrect because it merely includes or excludes existing fields from results without generating new fields.

Answer

table

Answer

convert

Answer

fields

Question 15

Which TWO of the following commands will return exactly one result row when there is at least one event?

Accepted Answer

top limit=1 user. Option E, `stats count`, is correct because it aggregates the entire result set into a single summary row containing the total number of events, so it returns exactly one row whenever at least one event exists. Option D, `top limit=1 user`, is correct because the `top` command returns the most common values of a field, and with `limit=1` it returns only the single highest-frequency user, yielding exactly one result row when events are present. Option A, `sort - count`, is not a valid aggregation and would sort by a field named count without collapsing events into one row. Option B, `chart count by user`, produces one row per distinct user value, so it can return many rows. Option C, `eventstats count by user`, adds an aggregate field to each event rather than reducing the result set, so it also returns multiple rows.

Answer

sort - count

Answer

chart count by user

Answer

eventstats count by user