SPLK-1001 Basic Searching and Transforming Commands Practice Test 2 — 15 Questions

Question 1

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Accepted Answer

The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.. The `stats` command in Splunk is specifically designed to compute summary statistics like count, sum, avg, and distinct count over a set of events. It transforms raw event data into aggregated results, making it a core transforming command for reporting and analysis.

Answer

The `stats` command displays a list of individual events with their fields.

Answer

The `stats` command is used to create new fields using the `eval` function.

Answer

The `stats` command can only be used with numeric fields.

Question 2

Refer to the exhibit. A security analyst runs the search and sees the result table. The analyst wants to see only the top 3 URI paths with their counts, without the percentage column. Which command modification achieves this?

Accepted Answer

`index=web sourcetype=access_combined | top limit=3 showperc=f uri_path`. The `top` command's `showperc=f` argument suppresses the percentage column, and `limit=3` restricts the output to the top 3 URI paths. This directly meets the requirement of showing only the top 3 URI paths with their counts, without the percentage column.

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path | fields - percent`

Answer

`index=web sourcetype=access_combined | top uri_path | head 3`

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path`

Question 3

A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?

Accepted Answer

Rewrite the search as `index=main error | stats count by host`.. The original search uses a pipe to the `search` command, which forces Splunk to retrieve all events from the index and then filter them in the search head, causing unnecessary I/O and CPU load. By rewriting the search as `index=main error`, the keyword `error` becomes part of the initial search string, allowing Splunk to use its index-time and search-time optimizations (e.g., inverted index lookups, bloom filters) to retrieve only matching events from disk, dramatically reducing the data scanned and improving performance without altering results.

Answer

Use the `transaction` command to group related events before counting.

Answer

Replace `stats count by host` with `top limit=5 host` to limit output.

Answer

Add a `summarize` command before `stats` to pre-aggregate data.

Question 4

Which three of the following are valid uses of the `stats` command in Splunk? (Choose three.)

Accepted Answer

Counting the number of events by a specific field using `count(field)`. The `stats` command in Splunk is used to perform statistical aggregations on search results. `count(field)` counts the number of events where the specified field exists, `avg(field)` calculates the mean of a numeric field, and `earliest(field)` returns the earliest (oldest) timestamp value for that field within each group. These are all valid aggregation functions that operate on field values across events.

Answer

Sorting results in descending order directly within the stats command

Answer

Joining two separate searches into a single stats output

Answer

Removing duplicate events based on a field using `dedup` inside the stats command

Question 5

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `rare` command returns the least common values of a field based on count.. The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. Importantly, by default, `top` and `rare` include events with null or empty values for the specified field as a separate value, rather than removing them automatically. Therefore, statement D is incorrect. Statements E and F are also false: `rare` can be used on any field, not just regex-extracted; and both commands have default limits (10 results) so the `limit` argument is optional.

Answer

The `rare` command can only be used on fields that have been extracted using regex.

Answer

Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Question 6

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Accepted Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.. Forwarder setup requires installation, configuration of output and input settings, restart, and verification.

Answer

Install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then verify that data is being forwarded to the indexer.

Answer

Configure outputs.conf to point to the indexer, then install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Question 7

Drag and drop the steps to create a Splunk dashboard with a single panel into the correct order.

Accepted Answer

Execute search, then Save As > Dashboard Panel, then select or create dashboard, then configure panel settings.. The correct sequence for creating a Splunk dashboard with a single panel is to first execute a search, then save it as a dashboard panel (not as a report), select or create the dashboard, and finally configure the panel settings. This ensures the panel is directly linked to the search and properly placed in the dashboard.

Answer

Create dashboard first, then execute search, then add panel to dashboard, then configure panel settings.

Answer

Execute search, then Save As > Report, then add report to dashboard as panel, then configure panel settings.

Answer

Add panel to dashboard first, then execute search, then save results, then configure panel settings.

Question 8

Match each Splunk role to its typical permission scope.

Accepted Answer

User: Can search and create reports, but cannot modify system settings.. In Splunk, the User role has basic search and reporting capabilities without system changes, Power User adds knowledge object creation, and Admin has full system and user management access.

Answer

User: Can manage user accounts.

Answer

Power User: Has full access to system configuration.

Answer

Admin: Can search and create reports but cannot modify system settings.

Question 9

Match each Splunk license type to its description.

Accepted Answer

Splunk Enterprise: Full-featured, licensed by daily indexing volume, includes search and alerting.. Splunk Enterprise provides full features with paid licensing based on daily index volume; Splunk Free is limited to 500 MB/day without authentication; Splunk Forwarder only forwards data; Splunk Cloud is a managed SaaS. Common confusions include mixing Enterprise and Free or Forwarder and Enterprise.

Answer

Splunk Enterprise: Forwards data to other Splunk instances; does not index or search locally.

Answer

Splunk Free: Full-featured, licensed by daily indexing volume, includes search and alerting.

Question 10

An analyst wants to find all events where the field 'status' is not 200. Which search is correct?

Accepted Answer

status != 200. All three options A, B, and C are valid searches to find events where the status field is not 200. In SPL, the `!=` operator can be written with or without spaces (options A and C), and the `NOT` keyword can be used to negate a condition (option B). Option D uses an invalid operator `-neq`, which is not recognized in Splunk SPL.

Answer

status -neq 200

Question 11

A user runs a search that returns thousands of results. They need to see only the first 100 events after sorting by time descending. Which command should they use?

Accepted Answer

sort - _time | head 100. The user needs the first 100 events after sorting by time descending. The `sort - _time` command sorts events in descending order by timestamp, and piping the result to `head 100` returns the first 100 events from that sorted list, which are the most recent 100 events. This is the correct approach because `head` returns events from the top of the result set, and sorting ensures the top events are the newest.

Answer

reverse

Answer

tail 100

Answer

head 100

Question 12

A search uses `eval memory_MB = memory_bytes / 1024 / 1024`. The field memory_bytes contains values like '2,048,000'. The eval results memory_MB is often null. What is the most likely cause?

Accepted Answer

The field is actually a string with commas.. The `memory_bytes` field contains values like '2,048,000', which include commas. In Splunk, fields with commas are treated as strings, not numeric values. When `eval` attempts arithmetic division on a string field, it returns null because the operation cannot be performed on non-numeric data. The commas must be removed (e.g., using `replace` or `tonumber`) before the field can be used in calculations.

Answer

The eval command has a syntax error.

Answer

The field needs to be converted first.

Answer

The division operator does not work on string fields.

Question 13

Which TWO of the following commands can be used to create a new field from existing fields?

Accepted Answer

rex. The `rex` command is correct because it uses regular expressions to extract new fields from existing field values. For example, `rex field=message "(?<newField>pattern)"` creates a new field named `newField` by matching a portion of the `message` field. This allows you to derive structured data from unstructured or semi-structured fields.

Answer

table

Answer

convert

Answer

fields

Question 14

Which THREE of the following are valid uses of the stats command?

Accepted Answer

stats avg(response_time) as avg_time. The `stats` command supports aggregation functions like `avg()` to compute the average of a field, and the `as` clause renames the resulting field. This is a standard and valid use of `stats` for statistical summarization.

Answer

stats eval(x=1) by category

Answer

stats table user

Question 15

Which TWO of the following commands will return exactly one result row when there is at least one event?

Accepted Answer

top limit=1 user. `top limit=1 user` returns the single most frequent value of the `user` field, producing exactly one result row (the top user) when at least one event exists. Option E is correct because `stats count` without a `by` clause aggregates all events into a single row showing the total event count, always returning exactly one row as long as there is at least one event.

Answer

sort - count

Answer

chart count by user

Answer

eventstats count by user