SPLK-1002 Basic Searching and Transforming Commands Practice Test 4 — 15 Questions

Question 1

A security analyst needs to find the number of failed login attempts per user. Which command group should be used?

Accepted Answer

stats count by user. The `stats count by user` command is correct because it groups events by the `user` field and calculates the count of events (failed login attempts) for each user, producing a table with two columns: `user` and `count`. This directly answers the requirement to find the number of failed login attempts per user using a transforming command that aggregates data.

Answer

top failed_login user

Answer

chart count by user

Answer

sort - count

Question 2

A user wants to see the top 10 source IP addresses generating 404 errors. Which SPL is correct?

Accepted Answer

index=web status=404 | top src_ip. Option A is correct because it first filters events with `index=web status=404` to isolate only 404 errors, then uses the `top` command to count occurrences of each `src_ip` value and return the top 10 by default. This directly answers the user's request for the top 10 source IPs generating 404 errors.

Answer

index=web status=404 | sort src_ip

Answer

index=web | top src_ip

Answer

index=web status=404 | rare src_ip

Question 3

An analyst runs: index=app sourcetype=log ERROR | stats count by host | where count > 5. What is the function of the where command in this search?

Accepted Answer

Filter the output of stats to show only hosts with count > 5. The `where` command filters the results of the `stats` calculation, keeping only rows where the `count` field exceeds 5. This is a post-processing filter applied after aggregation, not a pre-filter on raw events. The `where` command operates on the output of `stats`, not on the original events.

Answer

Remove duplicate hosts

Answer

Filter events that contain ERROR before counting

Answer

Rename the count field

Question 4

A user needs to create a report showing the average response time per endpoint for the last hour. Which command would produce this result?

Accepted Answer

stats avg(response_time) by endpoint. Option D is correct because the `stats` command with `avg(response_time) by endpoint` calculates the average response time for each unique endpoint, which directly meets the requirement of showing average response time per endpoint for the last hour. The `stats` command is the standard way to compute aggregate statistics like average over grouped fields in Splunk.

Answer

chart avg(response_time) over endpoint

Answer

eval avg(response_time)

Answer

top endpoint

Question 5

A large enterprise uses Splunk to monitor 500+ servers. A search returns results slowly due to high data volume. Which best practice can improve performance when using the top command?

Accepted Answer

Add a limit to top, e.g., top limit=20. Option C is correct because adding a limit to the top command (e.g., top limit=20) restricts the number of results returned, reducing the computational load and memory usage. In high-volume environments, this directly improves search performance by limiting the aggregation work Splunk must perform across all 500+ servers.

Answer

Use the fields command to remove unnecessary fields

Answer

Use rare instead of top to reduce output

Answer

Apply the sort command before top

Question 6

An analyst wants to find events where the field 'user' is not present. Which search correctly identifies such events?

Accepted Answer

NOT isnotnull(user). Option C is correct because the `NOT isnotnull(user)` search uses the `isnotnull()` function to check if the `user` field exists and is not null, then negates it with `NOT` to return only events where the `user` field is absent or null. In Splunk, fields that are not present in an event are considered null, so this combination accurately identifies events lacking the field.

Answer

user=null

Answer

-user

Answer

user=""

Question 7

A user needs to see the trend of login failures over the past 7 days, broken down by hour. Which command should be used?

Accepted Answer

timechart count by _time. C is correct because `timechart count by _time` automatically creates a time-based chart with login failures aggregated per hour over the past 7 days. The `timechart` command splits the time range into equal-span buckets (default 1 hour for a 7-day window) and counts events in each bucket, displaying the trend over time. The `by _time` clause is redundant but not harmful; the command inherently uses `_time` as the x-axis.

Answer

stats count by _time

Answer

eval count

Answer

chart count over _time

Question 8

A search returns many duplicate events due to data source redundancy. Which command can remove duplicate events based on a specific field?

Accepted Answer

dedup event_id. The `dedup` command removes duplicate events based on the values of one or more specified fields. In this case, `dedup event_id` will keep only the first occurrence of each unique `event_id` value, discarding subsequent duplicates. This is the correct command for removing duplicate events based on a specific field.

Answer

uniq event_id

Answer

fields event_id

Answer

sort event_id

Question 9

An analyst executes the following search: index=main sourcetype=access | stats dc(user) by host. What does dc(user) do?

Accepted Answer

Distinct count of users per host. The `dc(user)` function in SPL stands for 'distinct count' of the `user` field. When used after `stats ... by host`, it calculates the number of unique users associated with each host. This is why option B is correct: it returns the distinct count of users per host.

Answer

Count of hosts

Answer

Count of all users

Answer

Sum of user IDs

Question 10

Which TWO commands can be used to create a chart that shows the count of events over time?

Accepted Answer

timechart. The `timechart` command is specifically designed to create a time-based chart where the x-axis represents time and the y-axis represents a statistical aggregation, such as count. By default, `timechart count` splits events into time buckets and counts the number of events in each bucket, making it ideal for showing event counts over time. The `chart` command can also produce a time-based chart when used with the `_time` field as the x-axis, but it requires explicit specification of the time field and does not automatically bucket by time like `timechart` does.

Answer

top

Answer

eval

Answer

stats

Question 11

Which THREE of the following are transforming commands in Splunk?

Accepted Answer

stats. The `stats`, `timechart`, and `chart` commands are all transforming commands in Splunk because they convert raw event data into statistical results, typically producing a table or time-based chart. Unlike non-transforming commands (e.g., `search` or `eval`), these commands change the data structure from events to a summary, which is required for visualizations and further statistical processing.

Answer

search

Answer

eval

Question 12

Which TWO factors should be considered when deciding to use the rare command instead of top?

Accepted Answer

The dataset has high cardinality in the field of interest. Option A is correct because the `rare` command is specifically designed to return the least common values of a field, making it ideal for high-cardinality fields where the `top` command would produce a long, less useful list of many low-frequency values. When a field has high cardinality (many unique values), `rare` helps surface the infrequent events that might be missed by `top`, which focuses on the most frequent values. This aligns with the use case of identifying outliers or anomalies in datasets with many distinct field values.

Answer

Rare is faster than top

Answer

Top is always preferred for security analysis

Answer

The user wants to view results sorted alphabetically

Question 13

Refer to the exhibit. What will be the output of this search?

Accepted Answer

The productId and its count for the 10 product IDs with the highest event counts. The search uses the `top` command, which by default returns the 10 most frequent values of the specified field (`productId`) based on event count, along with their counts. Option D correctly describes this output: the `productId` and its count for the 10 product IDs with the highest event counts.

Answer

All productId values sorted alphabetically

Answer

ProductId values with count=0

Answer

The top 10 productId values based on event count

Question 14

A medium-sized company uses Splunk to monitor its e-commerce platform. The platform generates around 10 million events per day from web servers, application logs, and databases. The security team wants to identify the top 10 IP addresses that trigger the most 403 Forbidden errors in the last 24 hours. However, when they run the search: index=ecom sourcetype=web status=403 | top src_ip, the search takes over 5 minutes to complete and sometimes times out. The team needs a faster approach that still accurately identifies the top IPs. The team's Splunk environment uses indexers and a search head. The data is not accelerated. What should the team do to improve search performance?

Accepted Answer

Create a report acceleration summary for the search or implement summary indexing. Option D is correct because report acceleration or summary indexing pre-computes and stores the results of the search, allowing subsequent runs to retrieve the aggregated data almost instantly. Given the environment has indexers and a search head but no acceleration, enabling report acceleration on the search creates a summary that updates periodically, bypassing the need to scan all raw events each time. This directly addresses the timeout issue by reducing the per-search data volume to the pre-built summary.

Answer

Replace 'top' with 'rare' to reduce the amount of data processed

Answer

Use 'stats count by src_ip | sort - count | head 10' instead of top

Answer

Add 'fields src_ip' before top to remove other fields

Question 15

A large financial institution uses Splunk to consolidate logs from thousands of ATMs. Each ATM sends a heartbeat event every 5 minutes containing fields: atm_id, timestamp, status (OK or ERROR), and firmware_version. The operations team wants to find the number of ATMs that have reported at least one ERROR status in the last hour. The initial search is: index=atm sourcetype=heartbeat status=ERROR | dedup atm_id | stats count. However, this search returns a count that is too high because some ATMs report multiple errors within the hour. The team needs an accurate count of ATMs that had any error, regardless of how many error events each ATM generated. The search must be efficient due to the high volume of events. Which approach should be used?

Accepted Answer

index=atm sourcetype=heartbeat status=ERROR | stats dc(atm_id) as errored_atms. Option B is correct because `stats dc(atm_id)` computes the distinct count of `atm_id` values, directly giving the number of unique ATMs that had at least one ERROR event in the last hour. This is efficient as it processes all matching events in a single pass without needing intermediate deduplication or subsearches, which is critical for high-volume ATM log data.

Answer

index=atm sourcetype=heartbeat status=ERROR | stats count(atm_id) as error_events | eval error_events

Answer

index=atm sourcetype=heartbeat status=ERROR | stats count by atm_id | where count >=1 | dedup atm_id | stats count

Answer

index=atm sourcetype=heartbeat status=ERROR | stats values(atm_id)