SPLK-1001 Basic Searching and Transforming Commands Practice Test 4 — 15 Questions

Question 1

A SOC analyst needs a quick count of events grouped by the sourcetype field for the last 24 hours, and wants the busiest sourcetypes listed first. Which SPL search accomplishes this?

Accepted Answer

index=main earliest=-24h | stats count by sourcetype | sort - count. The stats command is a transforming command that aggregates events into a result set grouped by sourcetype, producing a count field for each group. Adding sort with a leading minus on count orders the groups from most to least frequent. Together they deliver exactly the grouped, descending count the analyst requested.

Answer

index=main earliest=-24h | table sourcetype | dedup sourcetype

Answer

index=main earliest=-24h | top sourcetype

Answer

index=main earliest=-24h | sort sourcetype | head 10

Question 2

An analyst needs to build a report from raw web access events. The analyst must first convert the raw events into a statistical result set before the pipeline can aggregate or visualize them. Which two commands perform that conversion? (Choose two.)

Accepted Answer

chart. Transforming commands convert the raw event stream into a results table, which is what reporting and visualization require. Both stats and chart perform that conversion by grouping events and emitting aggregated rows, so they are the transforming commands in this list. Commands such as eventstats, rex, and lookup modify or enrich events while preserving the event stream, so they are streaming commands and do not satisfy the requirement.

Answer

eventstats

Answer

rex

Answer

lookup

Question 3

A security analyst wants to identify the top 5 source IP addresses responsible for the most failed login attempts in the last hour. The search should display only the IP address and the count of failures. Which SPL search should the analyst use?

Accepted Answer

index=auth action=failure earliest=-1h | top limit=5 src_ip. The correct search must filter for failed logins in the last hour, count by source IP, sort descending by count, and limit to 5. The stats command with a subsequent sort and head achieves this and outputs only the IP and count fields. Using top would include a percent column by default, which violates the requirement to display only IP and count.

Answer

index=auth action=failure earliest=-1h | stats count by src_ip | sort -count | head 5

Answer

index=auth action=failure earliest=-1h | top 5 src_ip

Answer

index=auth action=failure earliest=-1h | stats count by src_ip | sort count | head 5

Question 4

An analyst runs a search that returns 250,000 events over the last 24 hours. They need to quickly identify the 15 most frequently occurring values of the field 'user_agent' and see what percentage of the total each represents. Which SPL search should they run?

Accepted Answer

index=web | top limit=15 user_agent. The top command is specifically designed to return the most common values of a field along with their count and percentage of the total. It is a transforming command that automatically calculates the percentage, making it the ideal choice for this scenario. The other options either miss the percentage requirement or use inefficient workarounds.

Answer

index=web | stats count by user_agent | sort - count | head 15

Answer

index=web | rare user_agent

Answer

Question 5

An analyst is building a report that must aggregate web access logs by URI path and then show only the five paths with the highest total bytes transferred. Which TWO SPL commands are required to produce this result? (Choose two.)

Accepted Answer

sort - sum(bytes). Producing a top-five list by total bytes requires two operations: aggregation and ordering. The stats command groups events by uri_path and sums the bytes field, creating one row per path with a total. The sort command with a descending modifier then arranges those rows so the largest totals are first, allowing the top five to be selected.

Answer

head 5

Answer

dedup uri_path

Answer

table uri_path, bytes

Question 6

A Splunk user is analyzing sales data in the 'sales' index. The user needs to calculate the total revenue per product category and also identify the single highest-selling product in each category. The data contains fields 'category', 'product_name', and 'revenue'. Which two searches will accomplish these goals? (Choose two.)

Accepted Answer

index=sales | stats sum(revenue) as total_revenue by category, product_name | sort - total_revenue | dedup category. To calculate total revenue per category, use stats sum(revenue) by category. To find the highest-selling product in each category by revenue, calculate sum(revenue) by category and product_name, sort descending by the total, and then dedup by category to keep the top product. The other options either count frequency, find maximum single revenue, or do not properly aggregate per product.

Answer

index=sales | top limit=1 product_name by category

Answer

index=sales | stats max(revenue) as max_revenue by category

Answer

index=sales | eventstats sum(revenue) as total_revenue by category | dedup category

Question 7

A Splunk user needs to create a report that shows the number of events per hour for the past 24 hours, but only for events where the status field is 'error'. The report should display the hour and the count. Which two SPL searches will produce the required results? (Choose two.)

Accepted Answer

index=app status=error earliest=-24h | bucket _time span=1h | stats count by _time. The timechart command with span=1h directly creates a time-based chart with hourly counts. Alternatively, using bucket to group _time into 1-hour intervals followed by stats count by _time achieves the same result. Both produce a table with hour and count. The other options either use incorrect fields, invalid functions, or do not bucket time properly.

Answer

index=app status=error earliest=-24h | stats count by date_hour

Answer

index=app status=error earliest=-24h | chart count over _time by status

Answer

index=app status=error earliest=-24h | timechart span=1h sum(status)

Question 8

A SOC analyst runs a search that returns a large number of events with fields 'src_ip', 'dest_ip', and 'action'. They want to create a table that shows, for each unique combination of 'src_ip' and 'dest_ip', the total number of events and the number of events where 'action' is 'blocked'. The final result should include columns for 'src_ip', 'dest_ip', 'total_count', and 'blocked_count'. Which SPL search accomplishes this?

Accepted Answer

index=firewall | stats count as total_count, count(eval(action="blocked")) as blocked_count by src_ip, dest_ip. The stats command with count(eval()) allows conditional counting within a single aggregation. By using count as total_count and count(eval(action="blocked")) as blocked_count, and grouping by src_ip and dest_ip, the search produces the required table efficiently. The other options either break the pipeline, use inefficient eventstats, or employ unconventional syntax.

Answer

index=firewall | stats count as total_count by src_ip, dest_ip | stats count(eval(action="blocked")) as blocked_count by src_ip, dest_ip

Answer

index=firewall | eventstats count as total_count by src_ip, dest_ip | eventstats count(eval(action="blocked")) as blocked_count by src_ip, dest_ip | table src_ip, dest_ip, total_count, blocked_count

Answer

index=firewall | stats sum(eval(action="blocked")) as blocked_count, count as total_count by src_ip, dest_ip

Question 9

A Splunk user is analyzing firewall logs and wants to identify the top 3 source IP addresses that generated the most denied traffic, and also see the total count of denied events for each of those IPs. The user writes the following search: index=firewall action=denied | top limit=3 src_ip. However, the results show more than 3 rows. Which two actions will correct the search to return exactly the top 3 source IPs? (Choose two.)

Accepted Answer

Ensure that the field src_ip is not multivalued; if it is, use mvexpand src_ip before the top command.. The issue is likely that the src_ip field is multivalued, causing top to count each value separately and return more than 3 rows because each unique IP is considered. Using mvexpand before top ensures each IP is treated as a separate event, allowing top limit=3 to work correctly. Alternatively, using stats count by src_ip followed by sort and head also correctly aggregates and limits to the top 3, as stats handles multivalue fields by splitting them.

Answer

Use the dedup command after top: top limit=3 src_ip | dedup src_ip

Answer

Change the command to: top limit=3 showperc=false src_ip

Answer

Add a sort command before top: sort - count | top limit=3 src_ip

Question 10

A SOC analyst wants to display a chronological list of the 20 most recent authentication events, showing only the user, action, and source IP fields. The events must appear with the newest event at the top. Which SPL search meets these requirements?

Accepted Answer

index=auth | sort - _time | head 20 | table user action src_ip. The correct sequence sorts the full result set by _time descending before limiting, ensuring the newest events are selected, and only then reduces the columns with table. Placing sort before head is essential because head otherwise truncates based on index order rather than recency, and table must come last so the _time field is still available for sorting.

Answer

index=auth | head 20 | sort - _time | table user action src_ip

Answer

index=auth | sort - _time | table user action src_ip | head 20

Answer

index=auth | table user action src_ip | sort - _time | head 20

Question 11

A Splunk user is analyzing web server logs and needs to identify the top 5 client IP addresses by the number of requests, but only for requests that resulted in HTTP status codes 400 or 500. The user writes the following search: index=web sourcetype=access_combined status=400 OR status=500 | top limit=5 clientip. However, the results show client IPs with various status codes, not just 400 or 500. Which two changes to the search will correctly return the top 5 client IPs for only status 400 and 500? (Choose two.)

Accepted Answer

Change the base search to: index=web sourcetype=access_combined (status=400 OR status=500). The correct approaches are to group the status conditions in parentheses within the base search or to use a where command after the base search. Both methods ensure that only events with status 400 or 500 are included before the top command calculates the top client IPs. The parentheses ensure proper logical grouping, while the where command provides an explicit post-filter.

Answer

Add a filter before the base search: status=400 OR status=500

Answer

Change the top command to: | top limit=5 clientip by status

Answer

Change the base search to: index=web sourcetype=access_combined status=400 OR 500

Question 12

A SOC analyst needs to identify the five source IP addresses that generated the most failed login events in the last 24 hours. The events contain a field named src_ip and an action field equal to 'failure'. The analyst wants a simple table sorted with the highest count at the top. Which search should be used?

Accepted Answer

index=security action=failure earliest=-24h | stats count by src_ip | sort - count | head 5. To find the top source IPs by failed login count, the events must first be filtered, then aggregated with stats count by src_ip, then ordered with sort - count, and finally limited with head 5. The stats command creates the count field, sort - count places the largest values first, and head 5 returns only the five highest. Commands that add extra columns or skip sorting do not satisfy the requirement.

Answer

index=security action=failure earliest=-24h | stats count by src_ip | head 5

Answer

index=security action=failure earliest=-24h | top limit=5 src_ip

Answer

index=security action=failure earliest=-24h | sort - count | stats count by src_ip | head 5

Question 13

A SOC analyst needs to find all failed login events from the last 24 hours and display only the user, src_ip, and action fields, sorted with the most recent event first. Which search accomplishes this?

Accepted Answer

index=security action=failure earliest=-24h | fields user, src_ip, action | sort - _time. The fields command preserves _time in the event pipeline while limiting visible fields, allowing sort - _time to order results newest first. Using table removes _time unless explicitly included, and sorting ascending would reverse the requested order. The correct search filters failed logins in the last 24 hours and displays only the requested fields in descending time order.

Answer

index=security action=failure earliest=-24h | fields user, src_ip, action | sort _time

Answer

index=security action=failure earliest=-24h | table user, src_ip, action | sort _time

Answer

index=security action=failure earliest=-24h | table user, src_ip, action | sort - _time

Question 14

An analyst runs index=web | top limit=3 uri_path and notices the output includes a percent column in addition to count. The analyst wants the same three most common URI paths but without the percent column. Which SPL search produces that result?

Accepted Answer

index=web | stats count by uri_path | sort - count | head 3. The top command adds a percent column that the analyst does not want. Replacing it with stats count by uri_path produces only the grouped field and the count, and adding sort with a descending modifier followed by head 3 reproduces the three most common paths in the correct order without the extra column.

Answer

index=web | rare limit=3 uri_path

Answer

index=web | top limit=3 uri_path | fields - percent

Answer

index=web | stats count by uri_path | head 3

Question 15

A Splunk user is building a search to rank the busiest source IP addresses in the 'proxy' index. The user wants one row per source IP showing how many requests it made, ordered from most to least requests, with only the top 10 shown. Which TWO SPL searches will produce that result? (Choose two.)

Accepted Answer

index=proxy | stats count by src | sort - count | head 10. Two valid patterns satisfy the requirement. The top command performs grouping, descending frequency sort, and truncation in one step and defaults to ten results. Alternatively, stats count by src followed by sort with a descending count and then head 10 achieves the same ranking manually. In both cases the truncation must occur after the frequency ordering, never before, or the wrong addresses are retained.

Answer

index=proxy | sort - src | stats count by src | head 10

Answer

index=proxy | stats count by src | head 10 | sort - count

Answer

index=proxy | rare limit=10 src