SPLK-1002 Basic Searching and Transforming Commands Practice Test 3 — 15 Questions

Question 1

A security analyst needs to find the number of failed login attempts per user in the last hour. The events contain a field 'result' with value 'failure'. Which search is correct?

Accepted Answer

index=security source=login result=failure | stats count by user. The `stats count by user` command correctly groups events by the `user` field and counts the number of events per user, which directly answers the question of failed login attempts per user. The search first filters events with `index=security`, `source=login`, and `result=failure`, then uses `stats` to aggregate the count per user. This is the most efficient and precise way to produce a table of user-to-failure-count mappings.

Answer

index=security source=login result=failure | top user

Answer

index=security source=login result=failure | timechart count by user

Answer

index=security source=login result=failure | chart count by user

Question 2

A user wants to see the top 5 most common values of the 'action' field in the web access logs. Which command should be used?

Accepted Answer

top. The `top` command is designed to find the most frequent values of a field. By default, it returns the top 10 results, but you can specify `limit=5` to get the top 5 most common values of the 'action' field in web access logs.

Answer

rare

Answer

fields

Answer

sort

Question 3

An analyst runs the search `index=web | stats count by status | sort - count` and wants to show only status codes with count greater than 100. Which command should be added before the sort?

Accepted Answer

where count>100. Option C is correct because the `where` command is used to filter results based on a condition after statistical aggregation. In this search, `stats count by status` creates a field called `count`, and `where count>100` filters the results to show only status codes with a count greater than 100. The `where` command operates on the results of the `stats` command, making it the appropriate choice for post-aggregation filtering.

Answer

eval count>100

Answer

search count>100

Answer

filter count>100

Question 4

A team needs to calculate the average response time for each URL path from web server logs. The response time is in a field 'duration'. Which search is correct?

Accepted Answer

index=web | stats avg(duration) by url_path. Option D is correct because the `stats avg(duration) by url_path` command computes the average of the 'duration' field for each distinct value of 'url_path', exactly matching the requirement to calculate average response time per URL path. The `stats` command with a `by` clause groups results by the specified field and applies the aggregation function to each group.

Answer

index=web | timechart avg(duration) by url_path

Answer

index=web | chart avg(duration) by url_path

Answer

index=web | eval avg_duration=avg(duration) | stats by url_path

Question 5

A search returns events with a field 'ip' that contains both IPv4 and IPv6 addresses. An analyst wants to count events for each IP type (IPv4 vs IPv6). Which command should be used to create a new field that categorizes the IP type?

Accepted Answer

eval. Option C is correct because the `eval` command can create a new field by evaluating an expression, such as using the `if` function with `like()` or `match()` to test whether the IP address contains a colon (IPv6) or a dot (IPv4). This allows the analyst to categorize each event's IP type into a new field like `ip_type` without altering the original data.

Answer

fields

Answer

convert

Answer

rex

Question 6

A search `index=main | top limit=10 user | fields - percent` is running slowly on a large dataset. Which change would likely improve performance the most?

Accepted Answer

Use stats count by user instead of top. The `top` command is a transforming command that internally performs a `sort` and `limit` after counting events. On large datasets, `top` can be slower than `stats count by user` because `top` includes additional overhead for calculating percentages and sorting all results before limiting. Using `stats count by user` followed by `sort 10 -count` achieves the same result with less processing overhead, as `stats` is more efficient for simple aggregation.

Answer

Add a rex command before top

Answer

Remove the fields command

Answer

Add a time range early in the search

Question 7

An analyst needs to find the count of events by source type for each day in the past week, but only for source types with more than 1000 events. Which search is correct?

Accepted Answer

index=* earliest=-7d | bucket _time span=1d | stats count by sourcetype _time | where count>1000. Option A is correct because it uses `bucket _time span=1d` to group events into daily time buckets, then `stats count by sourcetype _time` to count events per source type per day, and finally `where count>1000` to filter for source types exceeding 1000 events per day. The `bucket` command is essential to create discrete daily intervals; without it, `stats count by sourcetype _time` would treat each unique _time value as a separate bucket, which is not the intended daily aggregation.

Answer

index=* earliest=-7d | stats count by sourcetype _time | where count>1000

Answer

index=* earliest=-7d | timechart count by sourcetype | search count>1000

Answer

index=* earliest=-7d | timechart count by sourcetype | where count>1000

Question 8

An analyst runs a search that returns 10,000 events. They want to see the distribution of the 'status' field across the 'method' field. Which command should be used?

Accepted Answer

stats count by status, method. Option B is correct because the `stats count by status, method` command groups events by both the 'status' and 'method' fields, then counts the number of events in each combination, producing a table that shows the distribution of status values across method values. This directly answers the requirement to see how the 'status' field is distributed across the 'method' field.

Answer

top method by status

Answer

pivot status method

Answer

chart count over status by method

Question 9

A user wants to remove duplicate events based on the 'transaction_id' field, keeping only the first occurrence. Which command is appropriate?

Accepted Answer

dedup transaction_id. The `dedup` command removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the user wants to keep the first occurrence of each unique `transaction_id`, `dedup transaction_id` is the correct and simplest approach.

Answer

fields - transaction_id

Answer

sort transaction_id | dedup transaction_id

Answer

uniq transaction_id

Question 10

Which two of the following search commands are transforming commands? (Choose two.)

Accepted Answer

chart. Transforming commands return a statistics table. chart and stats are transforming; eval, search, and fields are non-transforming.

Answer

search

Answer

eval

Answer

fields

Question 11

Which two components are required to create a time-based chart of average CPU usage per host over the last 4 hours? (Choose two.)

Accepted Answer

timechart avg(cpu) by host. Option A is correct because `timechart` is the Splunk command specifically designed to create time-based charts, and `avg(cpu) by host` computes the average CPU usage aggregated per host over time. This command automatically splits the results into time buckets and generates a chart with time on the x-axis and the average CPU per host as series.

Answer

stats avg(cpu) by host

Answer

the top command

Answer

the fields command

Question 12

Which three of the following are valid ways to filter events before a transforming command? (Choose three.)

Accepted Answer

Use the `eval` command to set a field and then `where` before the transforming command.. Option A is correct because the `eval` command can create or modify fields, and the `where` command can then filter events based on those computed fields. Placing `where` before a transforming command (like `stats` or `timechart`) filters events before aggregation, which is essential for accurate results. This is a common pattern for conditional filtering in Splunk.

Answer

Use the `fields` command to remove unwanted fields.

Answer

Use the `where` command after the transforming command.

Question 13

Refer to the exhibit. An analyst runs this search and expects to see a table of status codes with their counts, filtered to those with count greater than 100. The search returns zero results even though there are many events. What is the most likely reason?

Accepted Answer

The rex command is incorrectly extracting the status_code field.. The rex command is incorrectly extracting the status_code field because the regular expression pattern does not match the actual format of the status codes in the events. If the pattern is wrong or the field is not captured correctly, the stats command will not find any values for status_code, resulting in zero results even though events exist. The where command then filters on a field that doesn't exist or is null, returning no rows.

Answer

The sourcetype should be 'access_combined' instead.

Answer

The stats command should use 'values(status_code)' instead.

Answer

The where command should be placed before the stats command.

Question 14

Refer to the exhibit. A security analyst runs this search and gets two rows: threat_level 'high' and 'low'. However, many events have threat_score between 60 and 90 that are not captured. How should the search be modified to include a 'medium' category?

Accepted Answer

Change the eval to a case statement with multiple conditions.. Using a case statement allows multiple conditions clearly. A nested if would work but is less readable. fillnull adds missing values, but the issue is categorization not missing data. search would filter, not categorize.

Answer

Use the `fillnull` command to add missing values.

Answer

Use the `search` command to filter threat_score>90.

Answer

Add a third condition: if(threat_score > 60 AND threat_score <=90, "medium", ...) inside the existing eval.

Question 15

Refer to the exhibit. An analyst wants to see the top 10 most visited URI paths, but the result also includes a 'percent' column. To remove the percent column, which command should be added?

Accepted Answer

| fields - percent. The `fields` command with a minus sign removes specified fields from the results. Since the question asks to remove the 'percent' column, `| fields - percent` is the correct and most direct way to drop that field while keeping all other fields intact.

Answer

| table uri_path count

Answer

| eval percent=null()

Answer

| rename percent as ""