SPLK-1001 Basic Searching and Transforming Commands Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. What will be the output of this search?

Accepted Answer

The productId and its count for the 10 product IDs with the highest event counts. The search uses the `top` command, which by default returns the 10 most frequent values of the specified field (`productId`) based on event count, along with their counts. Option D correctly describes this output: the `productId` and its count for the 10 product IDs with the highest event counts.

Answer

All productId values sorted alphabetically

Answer

ProductId values with count=0

Answer

The top 10 productId values based on event count

Question 2

A medium-sized company uses Splunk to monitor its e-commerce platform. The platform generates around 10 million events per day from web servers, application logs, and databases. The security team wants to identify the top 10 IP addresses that trigger the most 403 Forbidden errors in the last 24 hours. However, when they run the search: index=ecom sourcetype=web status=403 | top src_ip, the search takes over 5 minutes to complete and sometimes times out. The team needs a faster approach that still accurately identifies the top IPs. The team's Splunk environment uses indexers and a search head. The data is not accelerated. What should the team do to improve search performance?

Accepted Answer

Create a report acceleration summary for the search or implement summary indexing. Report acceleration or summary indexing pre-computes and stores the results of the search, allowing subsequent runs to retrieve the aggregated data almost instantly. Given the environment has indexers and a search head but no acceleration, enabling report acceleration on the search creates a summary that updates periodically, bypassing the need to scan all raw events each time. This directly addresses the timeout issue by reducing the per-search data volume to the pre-built summary.

Answer

Replace 'top' with 'rare' to reduce the amount of data processed

Answer

Use 'stats count by src_ip | sort - count | head 10' instead of top

Answer

Add 'fields src_ip' before top to remove other fields

Question 3

A large financial institution uses Splunk to consolidate logs from thousands of ATMs. Each ATM sends a heartbeat event every 5 minutes containing fields: atm_id, timestamp, status (OK or ERROR), and firmware_version. The operations team wants to find the number of ATMs that have reported at least one ERROR status in the last hour. The initial search is: index=atm sourcetype=heartbeat status=ERROR | dedup atm_id | stats count. However, this search returns a count that is too high because some ATMs report multiple errors within the hour. The team needs an accurate count of ATMs that had any error, regardless of how many error events each ATM generated. The search must be efficient due to the high volume of events. Which approach should be used?

Accepted Answer

index=atm sourcetype=heartbeat status=ERROR | stats dc(atm_id) as errored_atms. `stats dc(atm_id)` computes the distinct count of `atm_id` values, directly giving the number of unique ATMs that had at least one ERROR event in the last hour. This is efficient as it processes all matching events in a single pass without needing intermediate deduplication or subsearches, which is critical for high-volume ATM log data.

Answer

index=atm sourcetype=heartbeat status=ERROR | stats count(atm_id) as error_events | eval error_events

Answer

index=atm sourcetype=heartbeat status=ERROR | stats count by atm_id | where count >=1 | dedup atm_id | stats count

Answer

index=atm sourcetype=heartbeat status=ERROR | stats values(atm_id)

Question 4

A user wants to find events where the status code is 500 or 503 and the response time is greater than 2 seconds. Which TWO SPL commands will correctly limit the results to only these events?

Accepted Answer

search (status=500 OR status=503) AND response_time>2. Option D is correct because it uses the search command with parentheses to group the OR condition for status codes 500 and 503, then combines it with AND response_time>2, which is valid SPL syntax for filtering events where either status code occurs and the response time exceeds 2 seconds. Option E is correct because it uses the IN operator to match status values 500 or 503, then pipes to where response_time>2 to filter events with response times greater than 2 seconds, which correctly applies both conditions. Option A is incorrect because status=500,503 is not valid SPL syntax for matching multiple values, and AND is not a valid SPL operator in that context. Option B is incorrect because without parentheses the OR and implicit AND precedence would not correctly group the status conditions with the response time filter. Option C is incorrect because the where command cannot reference response_time as a field unless it was already extracted, and the OR condition lacks proper grouping with the response time filter.

Answer

status=500,503 AND response_time>2

Answer

search status=500 OR status=503 response_time>2

Answer

status=500 OR status=503 | where response_time>2

Question 5

A network operations team uses Splunk to monitor netflow data stored in index='net' and sourcetype='netflow'. The events contain fields: src_ip, dest_ip, bytes, and protocols. The team needs to identify the top 5 source IPs by total bytes transferred (based on the bytes field). For each of those top source IPs, they also want to list the destination IPs and the number of times they communicated. The data volume is large, so performance is important. Which SPL approach returns the desired results efficiently?

Accepted Answer

index=net sourcetype=netflow [ search index=net sourcetype=netflow | stats sum(bytes) as total_bytes by src_ip | sort -total_bytes | head 5 | fields src_ip ] | stats count by src_ip, dest_ip. It uses a subsearch to first identify the top 5 source IPs by total bytes, then passes those IPs to the outer search to efficiently compute the count of communications per destination IP. This approach minimizes the data processed in the outer search by filtering only the relevant source IPs, which is critical for performance on large netflow datasets.

Answer

index=net sourcetype=netflow | eventstats sum(bytes) as total_bytes by src_ip | stats count by src_ip, dest_ip

Answer

index=net sourcetype=netflow | stats sum(bytes) as total_bytes, count by src_ip, dest_ip | sort -total_bytes | head 5

Answer

index=net sourcetype=netflow | top limit=5 src_ip by bytes | fields src_ip | search index=net sourcetype=netflow | stats count by src_ip, dest_ip

Question 6

A Splunk administrator is troubleshooting a slow search on firewall logs. The index is 'firewall', sourcetype is 'cisco:asa', and there is about 500 GB of data per day. The search is: index=firewall sourcetype=cisco:asa action=block | stats count by src_ip | where count > 1000. This search takes over 5 minutes to return results. The administrator needs the same results faster. The index has a data model named 'firewall_dm' that is accelerated with a summary range of 7 days. Which change to the search will improve performance the most while still returning the same results?

Accepted Answer

Change to | tstats count from datamodel=firewall_dm where action=block by src_ip | where count > 1000. It uses `tstats` against an accelerated data model, which pre-aggregates data in the summary range (7 days). This avoids scanning raw 500 GB/day of firewall logs, drastically reducing I/O and CPU. The `where` clause in `tstats` filters on the `action` field directly from the accelerated index, returning the same results much faster.

Answer

Add | stats count by src_ip, _time to the search

Answer

Add | fields src_ip before the stats command

Answer

| search action=block instead of placing action=block in the base search

Question 7

Refer to the exhibit. A user runs the search and gets no results. Which is the most likely cause?

Accepted Answer

The 'status' field does not exist in the data. The search returns no results because the 'status' field referenced in the 'where' clause does not exist in the indexed data. In Splunk, the 'where' command filters events based on field values; if the field is absent, no events match the condition, resulting in zero results. The 'stats' command would have created a 'status' field only if it was used with an aggregation function like 'count by status', but the search shows 'stats count' without a 'by' clause, so 'status' remains undefined.

Answer

The 'sort' command must come before 'where'

Answer

The 'stats' command cannot be used with 'where'

Answer

The 'index' parameter is misspelled

Question 8

Refer to the exhibit. The search returns no results. What is the most likely reason?

Accepted Answer

The 'regex' command cannot extract fields; use 'rex' instead. The regex uses named capture groups, but Splunk's 'regex' command does not support creating fields with named capture groups. The 'rex' command should be used instead to extract fields.

Answer

The sourcetype is incorrect

Answer

The regex pattern is invalid

Answer

The 'top' command requires a field to be extracted first

Question 9

Refer to the exhibit. A user gets an error: 'Error in 'where' command: The field 'count' is not a numeric type.' What is the issue?

Accepted Answer

The 'timechart' command creates multiple 'count' fields for each host, so 'count' is not a single numeric field. The `timechart` command produces a multiseries result where each host becomes a separate series, and the count values are stored in a field that is not a single numeric field named `count` — it is a series field. Therefore `where count > 100` fails because `count` is not a numeric field in that context.

Answer

The syntax should be 'where count > "100"'

Answer

The 'count' field is a string type

Answer

The 'where' command should be placed before 'timechart'

Question 10

Refer to the exhibit. The search returns zero results. What is a likely cause?

Accepted Answer

The 'raw_data' field may not contain valid JSON. The search returns zero results likely because the 'raw_data' field does not contain valid JSON, so the 'spath' command fails to extract the 'response.status' field, and subsequent commands like 'stats' produce no results.

Answer

The 'spath' command should use 'output=response.status' to create the field

Answer

The search should be 'sourcetype=json_logs' first

Answer

The 'stats' command cannot use 'response.status' because it's not a field

Question 11

Refer to the exhibit. The search returns only events where src_zone is 'external'. What is the problem?

Accepted Answer

The 'case' function cannot compare IP addresses to CIDR ranges. The `case` function in SPL cannot compare IP addresses to CIDR ranges directly because it expects boolean expressions, not IP-matching operators. The correct approach is to use the `cidrmatch` function within the `case` function to evaluate whether `src_ip` falls within a given CIDR range. Without `cidrmatch`, the comparison `src_ip='10.0.0.0/8'` is treated as a string equality check, which will never match an IP address to a CIDR notation string.

Answer

The 'src_ip' field is not extracted

Answer

The default condition should be 'true()' instead of '1=1'

Answer

The 'search' command should be before 'eval'

Question 12

Refer to the exhibit. A security analyst runs a search to identify HTTP 500 errors over time. Which time period shows the highest count of 500 errors?

Accepted Answer

04:00:00 - 05:00:00. The exhibit shows the highest count of HTTP 500 errors occurring between 04:00:00 and 05:00:00, with a count of 89. This is determined by comparing the values for each hourly bucket: A: 23, B: 45, C: 67, D: 89. The highest value is 89, corresponding to the 04:00-05:00 time period.

Answer

00:00:00 - 01:00:00

Answer

01:00:00 - 02:00:00

Answer

03:00:00 - 04:00:00

Question 13

Refer to the exhibit. A security analyst runs a search to count failed login attempts by hour. Which hour has the highest number of failed login attempts?

Accepted Answer

14:00. The search counts failed login attempts by hour using a Splunk timechart or stats command with a time-based bucket. The exhibit shows that the hour with the highest count is 14:00, which has the peak value in the results table or chart. This is determined by sorting or visually inspecting the count per hour, where 14:00 exceeds all other hourly totals.

Answer

22:00

Answer

03:00

Answer

09:00

Question 14

Refer to the exhibit. A Splunk admin runs a search using a lookup file. What is the result of the stats command?

Accepted Answer

app=payment, owners=alice dave. The stats command with values(owner) by app aggregates all distinct owner values for each app into a multivalue field. For app=payment, the lookup returns owners alice and dave, so the result is app=payment, owners=alice dave. Option D correctly represents this multivalue output.

Answer

app=payment, owners=dave

Answer

app=payment, owners=alice,bob,charlie,dave

Answer

app=payment, owners=alice

Question 15

A security analyst has an index named 'web' that contains Apache access logs plus a small number of internal health-check events from the host 'probe-01'. The analyst needs a result set that contains only the Apache events and must not lose any of them. Which search should be used?

Accepted Answer

index=web NOT host=probe-01. Excluding a single known host is best done with the inline NOT operator, which removes only matching events and leaves everything else untouched. The != comparison and where-based negations behave differently because events lacking the host field fail a not-equal test and are silently dropped. For an analyst who must not lose Apache access-log data, NOT host=probe-01 is the safe, precise filter.

Answer

index=web host!=probe-01

Answer

index=web | search NOT host=probe-01

Answer

index=web | where host!=probe-01