SPLK-1001 Basic Searching and Transforming Commands Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A user runs this search. The results show only Error and Warning, but no Info. What is the most likely reason?

Accepted Answer

The stats command omitted the info severity because it has zero count.. The stats command with count() only returns results for field values that have at least one event. Since no events had severity=Info after the eval, Info has a count of zero and is omitted from the output. This is the expected behavior of stats — it does not include zero-count buckets unless explicitly requested with the `usenull=f` or similar options.

Answer

The eval command has a syntax error.

Answer

The sort command filters out Info.

Answer

The case statement does not evaluate to a string for Info.

Question 2

Refer to the exhibit. A user runs this search. The results show only Error and Warning, but no Info. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The time range is set to the past 24 hours by default.. By default, Splunk searches are restricted to the last 24 hours (unless a different time range is explicitly selected). Even though the user expects results for the past week, the search is only looking at the most recent 24 hours of data. This causes the counts to be lower than expected because events from earlier in the week are not included.

Answer

The sort command is not needed.

Answer

The head command restricts results.

Answer

The stats command counts all time.

Question 3

Refer to the exhibit. The search runs but the user field is not modified. What is the most likely cause?

Accepted Answer

The function name is misspelled (should be lower).. The `lower()` function in Splunk's `eval` command is case-sensitive and must be written in lowercase. The exhibit shows `Lower(user)` with a capital 'L', which Splunk does not recognize as a valid function, so the `eval` command fails silently and the `user` field remains unmodified.

Answer

The eval command does not modify existing fields.

Answer

The search must be run over a time range.

Answer

The field must be referenced as 'user'.

Question 4

A security analyst needs to find the number of failed login attempts per user in the last hour. The events contain a field 'result' with value 'failure'. Which search is correct?

Accepted Answer

index=security source=login result=failure | stats count by user. The `stats count by user` command correctly groups events by the `user` field and counts the number of events per user, which directly answers the question of failed login attempts per user. The search first filters events with `index=security`, `source=login`, and `result=failure`, then uses `stats` to aggregate the count per user. This is the most efficient and precise way to produce a table of user-to-failure-count mappings.

Answer

index=security source=login result=failure | top user

Answer

index=security source=login result=failure | timechart count by user

Answer

index=security source=login result=failure | chart count by user

Question 5

A user wants to see the top 5 most common values of the 'action' field in the web access logs. Which command should be used?

Accepted Answer

top. The `top` command is designed to find the most frequent values of a field. By default, it returns the top 10 results, but you can specify `limit=5` to get the top 5 most common values of the 'action' field in web access logs.

Answer

rare

Answer

fields

Answer

sort

Question 6

An analyst runs the search `index=web | stats count by status | sort - count` and wants to show only status codes with count greater than 100. Which command should be added before the sort?

Accepted Answer

where count>100. The `where` command is used to filter results based on a condition after statistical aggregation. In this search, `stats count by status` creates a field called `count`, and `where count>100` filters the results to show only status codes with a count greater than 100. The `where` command operates on the results of the `stats` command, making it the appropriate choice for post-aggregation filtering.

Answer

eval count>100

Answer

search count>100

Answer

filter count>100

Question 7

A team needs to calculate the average response time for each URL path from web server logs. The response time is in a field 'duration'. Which search is correct?

Accepted Answer

index=web | stats avg(duration) by url_path. The `stats avg(duration) by url_path` command computes the average of the 'duration' field for each distinct value of 'url_path', exactly matching the requirement to calculate average response time per URL path. The `stats` command with a `by` clause groups results by the specified field and applies the aggregation function to each group.

Answer

index=web | timechart avg(duration) by url_path

Answer

index=web | chart avg(duration) by url_path

Answer

index=web | eval avg_duration=avg(duration) | stats by url_path

Question 8

A search returns events with a field 'ip' that contains both IPv4 and IPv6 addresses. An analyst wants to count events for each IP type (IPv4 vs IPv6). Which command should be used to create a new field that categorizes the IP type?

Accepted Answer

eval. The `eval` command can create a new field by evaluating an expression, such as using the `if` function with `like()` or `match()` to test whether the IP address contains a colon (IPv6) or a dot (IPv4). This allows the analyst to categorize each event's IP type into a new field like `ip_type` without altering the original data.

Answer

fields

Answer

convert

Answer

rex

Question 9

A search `index=main | top limit=10 user | fields - percent` is running slowly on a large dataset. Which change would likely improve performance the most?

Accepted Answer

Use stats count by user instead of top. The `top` command is a transforming command that internally performs a `sort` and `limit` after counting events. On large datasets, `top` can be slower than `stats count by user` because `top` includes additional overhead for calculating percentages and sorting all results before limiting. Using `stats count by user` followed by `sort 10 -count` achieves the same result with less processing overhead, as `stats` is more efficient for simple aggregation.

Answer

Add a rex command before top

Answer

Remove the fields command

Answer

Add a time range early in the search

Question 10

An analyst needs to find the count of events by source type for each day in the past week, but only for source types with more than 1000 events. Which search is correct?

Accepted Answer

index=* earliest=-7d | bucket _time span=1d | stats count by sourcetype _time | where count>1000. It uses `bucket _time span=1d` to group events into daily time buckets, then `stats count by sourcetype _time` to count events per source type per day, and finally `where count>1000` to filter for source types exceeding 1000 events per day. The `bucket` command is essential to create discrete daily intervals; without it, `stats count by sourcetype _time` would treat each unique _time value as a separate bucket, which is not the intended daily aggregation.

Answer

index=* earliest=-7d | stats count by sourcetype _time | where count>1000

Answer

index=* earliest=-7d | timechart count by sourcetype | search count>1000

Answer

index=* earliest=-7d | timechart count by sourcetype | where count>1000

Question 11

An analyst runs a search that returns 10,000 events. They want to see the distribution of the 'status' field across the 'method' field. Which command should be used?

Accepted Answer

stats count by status, method. The `stats count by status, method` command groups events by both the 'status' and 'method' fields, then counts the number of events in each combination, producing a table that shows the distribution of status values across method values. This directly answers the requirement to see how the 'status' field is distributed across the 'method' field.

Answer

top method by status

Answer

pivot status method

Answer

chart count over status by method

Question 12

A user wants to remove duplicate events based on the 'transaction_id' field, keeping only the first occurrence. Which command is appropriate?

Accepted Answer

dedup transaction_id. The `dedup` command removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the user wants to keep the first occurrence of each unique `transaction_id`, `dedup transaction_id` is the correct and simplest approach.

Answer

fields - transaction_id

Answer

sort transaction_id | dedup transaction_id

Answer

uniq transaction_id

Question 13

Which two of the following search commands are transforming commands? (Choose two.)

Accepted Answer

chart. The `chart` command is a transforming command because it converts raw event data into a data table (statistical summary) by applying an aggregation function (e.g., count, avg) over a specified field, producing results that can be further visualized or pivoted. This transformation changes the data structure from a list of events to a tabular format with rows and columns.

Answer

search

Answer

eval

Answer

fields

Question 14

Which two components are required to create a time-based chart of average CPU usage per host over the last 4 hours? (Choose two.)

Accepted Answer

timechart avg(cpu) by host. `timechart` is the Splunk command specifically designed to create time-based charts, and `avg(cpu) by host` computes the average CPU usage aggregated per host over time. This command automatically splits the results into time buckets and generates a chart with time on the x-axis and the average CPU per host as series.

Answer

stats avg(cpu) by host

Answer

the top command

Answer

the fields command

Question 15

Which three of the following are valid ways to filter events before a transforming command? (Choose three.)

Accepted Answer

Use the `eval` command to set a field and then `where` before the transforming command.. The `eval` command can create or modify fields, and the `where` command can then filter events based on those computed fields. Placing `where` before a transforming command (like `stats` or `timechart`) filters events before aggregation, which is essential for accurate results. This is a common pattern for conditional filtering in Splunk.

Answer

Use the `fields` command to remove unwanted fields.

Answer

Use the `where` command after the transforming command.