SPLK-1001 Basic Searching and Transforming Commands Practice Test 10 — 15 Questions

Question 1

An analyst needs to calculate the average response time for each HTTP status code, but only for status codes that have at least 100 events. The field 'response_time' is numeric and 'status' is a string. Which SPL search accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=web | stats avg(response_time) as avg_rt count by status | where count >= 100. To calculate the average response time per status code and filter by the number of events, you must include count in the stats command and then use where to filter on count. The stats command must generate both avg(response_time) and count, grouped by status. Placing where after stats allows filtering on the aggregated count field. Filtering on avg_rt or placing where before stats does not meet the requirement.

Answer

index=web | where count >= 100 | stats avg(response_time) as avg_rt by status

Answer

index=web | stats avg(response_time) as avg_rt by status | search count >= 100

Answer

index=web | stats avg(response_time) as avg_rt by status | where avg_rt >= 100

Question 2

A Splunk user wants to calculate the 95th percentile of response times for each API endpoint from a set of logs. The events contain fields 'endpoint' and 'response_time'. Which search will produce this result?

Accepted Answer

index=api | stats p95(response_time) by endpoint. The stats command with the p95 function calculates the 95th percentile of a numeric field. When combined with a by clause, it groups the results by the specified field, producing a table with each endpoint and its 95th percentile response time. The other options calculate different statistics or use eventstats, which does not produce a summary table.

Answer

index=api | stats median(response_time) by endpoint

Answer

index=api | eventstats p95(response_time) by endpoint

Answer

index=api | stats avg(response_time) by endpoint

Question 3

A NOC analyst needs to display the 20 slowest web transactions from the last hour in a Splunk search. The events contain a numeric field named response_time_ms. The analyst wants the output to show the largest response_time_ms values first. Which SPL search accomplishes this?

Accepted Answer

index=web sourcetype=access_combined earliest=-1h | sort - response_time_ms | head 20. Sorting by the response_time_ms field with a leading minus sign orders the largest values first, and head 20 then returns only those top rows. The command sequence is critical: the sort must occur before the limiting command so that the entire result set is considered. Reversing the sort sign or using top would produce the wrong set of transactions.

Answer

index=web sourcetype=access_combined earliest=-1h | sort + response_time_ms | head 20

Answer

index=web sourcetype=access_combined earliest=-1h | top limit=20 response_time_ms

Answer

index=web sourcetype=access_combined earliest=-1h | head 20 | sort - response_time_ms

Question 4

A network engineer needs to identify the five hosts that generated the most firewall deny events in the last 24 hours. The raw events contain a field named src_ip. Which search returns exactly those five hosts and their event counts?

Accepted Answer

index=firewall action=denied earliest=-24h | top limit=5 src_ip. The top command is specifically designed to surface the most frequent values of a field and includes an optional limit argument that caps the number of results. Supplying limit=5 src_ip returns the five hosts with the highest deny-event counts along with count and percent columns, directly answering the requirement without extra sorting or filtering commands.

Answer

index=firewall action=denied earliest=-24h | stats count by src_ip | head 5

Answer

index=firewall action=denied earliest=-24h | table src_ip | dedup 5 src_ip

Answer

index=firewall action=denied earliest=-24h | rare limit=5 src_ip

Question 5

A compliance officer asks for a report of the total count of events per sourcetype, but only for sourcetypes that have more than 1000 events. Which search returns this?

Accepted Answer

index=main | stats count by sourcetype | where count > 1000. Aggregation must occur before filtering on the aggregated value. The stats command creates the count field per sourcetype, and the where command then filters rows where count exceeds 1000. Placing where before stats fails because count does not exist yet, and using search or top does not correctly filter or fully aggregate the data.

Answer

index=main | top sourcetype | where count > 1000

Answer

index=main | stats count by sourcetype | search count > 1000

Answer

index=main | where count > 1000 | stats count by sourcetype

Question 6

An analyst wants to create a report that shows the average response time for each HTTP status code over the past week, but only for status codes that appear more than 100 times. The events contain fields named status and response_time. Which search produces the required report?

Accepted Answer

index=web earliest=-7d | stats avg(response_time) as avg_rt count by status | where count > 100. The report requires two aggregations, average response time and event count, grouped by status, followed by a filter on the count. The stats command computes both values in one pass, and the where command then filters the aggregated rows to those with count greater than 100. Filtering before aggregation or using search for the numeric comparison leads to incorrect results.

Answer

index=web earliest=-7d | stats avg(response_time) as avg_rt count by status | search count > 100

Answer

index=web earliest=-7d | where count > 100 | stats avg(response_time) as avg_rt count by status

Answer

index=web earliest=-7d | stats avg(response_time) as avg_rt by status | search count > 100

Question 7

A Splunk administrator is reviewing a search that uses several commands and wants to identify which of the following are transforming commands that will change the result set into a statistical table. (Choose two.)

Accepted Answer

top. Transforming commands convert events into a statistical table by aggregating data. The stats and top commands both perform aggregation and produce summarized results, making them transforming commands. The eval, table, and rename commands modify or display fields but do not aggregate, so they are not transforming commands.

Answer

table

Answer

eval

Answer

rename

Question 8

A security analyst is investigating authentication events and wants to see a breakdown of the number of events for each combination of src and dest IP addresses, but only for combinations that have more than 100 events. The events contain src and dest fields. Which SPL search returns the desired results?

Accepted Answer

index=auth | stats count by src, dest | where count > 100. Grouping by two fields with stats count by src, dest creates one row per unique pair and calculates the event count for each. Applying where count > 100 afterward keeps only those pairs that exceed the threshold. Because where evaluates fields created by stats, the aggregation must come first, and the filter must use where rather than search for a numeric comparison.

Answer

index=auth | stats count by src, dest | head 100

Answer

index=auth | stats count by src, dest | search count > 100

Answer

index=auth | where count > 100 | stats count by src, dest

Question 9

A Splunk user needs to create a timechart that shows the number of successful and failed login attempts per hour over the last 24 hours, with separate lines for success and failure. The events contain an action field with values 'success' and 'failure'. Which search produces the required timechart?

Accepted Answer

index=auth earliest=-24h | timechart span=1h count by action. A timechart with separate lines per action value is created by using timechart span=1h count by action. The by clause splits the aggregation into one series per distinct value of the action field, so success and failure appear as separate lines. Using chart without a time field, or misusing count(action), fails to produce the required hourly series.

Answer

index=auth earliest=-24h | chart count by action

Answer

index=auth earliest=-24h | timechart span=1h count(action)

Answer

index=auth earliest=-24h | stats count by action, _time | timechart span=1h count

Question 10

An analyst needs to find the average duration of transactions per host, but only for hosts where the average duration exceeds 300 milliseconds. The events contain host and duration fields. Which search will produce this result?

Accepted Answer

index=app | stats avg(duration) as avg_duration by host | where avg_duration > 300. To filter on an aggregated value, the aggregation must happen first. The stats command computes the average duration per host, and the where command then filters those results for averages over 300. Attempting to use where or search before or instead of the aggregation, or misusing eval, will not correctly produce the filtered averages.

Answer

index=app | eval avg_duration = avg(duration) | stats avg(avg_duration) by host | where avg_duration > 300

Answer

index=app | where avg(duration) > 300 | stats avg(duration) as avg_duration by host

Answer

index=app | stats avg(duration) as avg_duration by host | search avg_duration > 300

Question 11

An analyst needs to produce a report that shows, for each sourcetype, the number of unique user accounts observed and the total number of events. Which search returns one row per sourcetype with both values?

Accepted Answer

index=main | stats dc(user) as unique_users count as total_events by sourcetype. The dc function computes the number of distinct values of a field, which is precisely how unique users should be counted, while count totals all matching events. Grouping both aggregations by sourcetype with stats produces one row per sourcetype containing the two requested metrics, and the as clauses provide clean column names.

Answer

index=main | stats values(user) as unique_users count as total_events by sourcetype

Answer

index=main | dedup user | stats count as unique_users by sourcetype

Answer

index=main | stats count(user) as unique_users count as total_events by sourcetype

Question 12

A fraud analyst wants to build a search that returns the total transaction amount and the number of transactions for each merchant, and then keep only merchants whose total amount exceeds 10,000. Which two SPL elements are required in the search pipeline? (Choose two.)

Accepted Answer

stats sum(amount) as total_amount count as txn_count by merchant. Producing per-merchant totals and transaction counts requires an aggregation stage, which stats provides with sum and count grouped by merchant. Filtering those aggregated rows against a numeric threshold requires the where command, because only where evaluates computed fields numerically after the transformation has occurred.

Answer

eval total_amount = sum(amount)

Answer

search total_amount > 10000

Answer

dedup merchant

Question 13

A Splunk user runs a search that returns events only when a user logs in from an external IP address. The user wants to count how many times each user logged in from external IPs, and then keep only users with more than 10 such logins. The search should return a table with two columns: 'user' and 'count'. Which SPL search accomplishes this?

Accepted Answer

index=security action=login src_ip=external | stats count by user | where count > 10. The requirement is to count logins per user and then filter users with more than 10 logins. The stats command with 'count by user' performs the grouping and counting, and the where command filters the aggregated results. This yields a table with user and count columns, exactly as needed. The other options either do not group by user, add extra columns, or return event-level results instead of a summary table.

Answer

index=security action=login src_ip=external | eventstats count as user_count | where user_count > 10

Answer

index=security action=login src_ip=external | stats count(user) | where count > 10

Answer

index=security action=login src_ip=external | top user | where count > 10

Question 14

A network operations analyst wants to view the number of firewall deny events per hour for the last seven days, showing a single series over time rather than a table of individual events. Which search produces this time-based summary?

Accepted Answer

index=firewall action=denied earliest=-7d | timechart span=1h count. A time-based summary across a fixed interval is best produced by a transforming command that buckets by _time. Using timechart with span=1h collapses the seven days of deny events into one row per hour and one column for the event count, giving a single series that can be charted directly as an hourly trend.

Answer

index=firewall action=denied earliest=-7d | eventstats count

Answer

index=firewall action=denied earliest=-7d | chart count by action

Answer

index=firewall action=denied earliest=-7d | stats count by _time

Question 15

A Splunk administrator is reviewing a search that uses the transaction command to group events by a session ID. The administrator wants to ensure the transaction command correctly groups events that occur within 30 minutes of each other and have the same session ID. The administrator also wants to limit the transaction to a maximum of 100 events. Which two parameters should be used with the transaction command to achieve this? (Choose two.)

Accepted Answer

maxevents=100. To group events by session ID within 30 minutes and limit to 100 events, the transaction command should use maxspan=30m to enforce the time window and maxevents=100 to cap the number of events per transaction. The startswith and endswith parameters are used to define transaction boundaries based on field values, not time or count limits. mvlist controls output formatting, not grouping constraints.

Answer

startswith=session_id

Answer

endswith=session_id

Answer

mvlist=true