SPLK-1001 Basic Searching and Transforming Commands Practice Test 5 — 15 Questions

Question 1

An analyst wants to find the number of events for each 'host' in the last 24 hours, but only for hosts that have more than 100 events. Which search will achieve this?

Accepted Answer

index=main earliest=-24h | stats count by host | where count > 100. The stats command aggregates events by host and calculates the count. The where command is then used to filter the aggregated results based on the count field. This is the correct approach to find hosts with more than 100 events. The search command cannot filter on calculated fields, top and rare do not filter by count threshold, and rare returns the least common values.

Answer

index=main earliest=-24h | rare host | where count > 100

Answer

index=main earliest=-24h | stats count by host | search count > 100

Answer

index=main earliest=-24h | top host limit=100

Question 2

An analyst wants to summarize web access logs by calculating the total bytes transferred and the number of events for each HTTP method. The analyst also needs to see only methods where the average bytes per event exceeds 5000. Which TWO SPL components are required to build this search? (Choose two.)

Accepted Answer

where avg_bytes > 5000. Building this summary requires an aggregation that computes total bytes, event count, and average bytes grouped by method, followed by a filter on the calculated average. The stats clause supplies all three metrics in one pass, and the where clause applies the numeric threshold to the resulting avg_bytes field, together producing the exact per-method report requested.

Answer

eval avg_bytes = bytes / event_count

Answer

transaction method maxspan=5m

Answer

search avg_bytes > 5000

Question 3

An analyst runs a search that returns events with a field named response_time that contains numeric values in milliseconds. The analyst wants to calculate the average response time per URI path and display only URIs where the average exceeds 500 ms. Which search is correct?

Accepted Answer

index=web | stats avg(response_time) as avg_rt by uri_path | where avg_rt > 500. The stats command computes the average response time per URI path, creating the avg_rt field. The where command then filters the aggregated results to those exceeding 500 ms. Filtering must occur after aggregation because per-event data does not contain the average. The other options either misuse where before stats, use search instead of where, or reference a non-existent command.

Answer

index=web | stats avg(response_time) as avg_rt by uri_path | filter avg_rt > 500

Answer

index=web | where avg(response_time) > 500 | stats avg(response_time) as avg_rt by uri_path

Answer

index=web | stats avg(response_time) as avg_rt by uri_path | search avg_rt > 500

Question 4

An analyst runs a search that returns thousands of events with a field named response_time in milliseconds. The analyst wants to display only the events where response_time is greater than 500, and then show the 20 slowest events first. Which search accomplishes this?

Accepted Answer

index=web | where response_time > 500 | sort - response_time | head 20. Filtering numeric fields requires the where command or a search with proper syntax, and sorting descending requires a minus sign before the field name. The combination of where for the threshold, sort - response_time for descending order, and head 20 for the top results yields the 20 slowest events. Other options misuse search syntax, sort direction, or the eval command.

Answer

index=web | eval response_time > 500 | sort - response_time | head 20

Answer

index=web | search response_time > 500 | sort response_time | head 20

Answer

index=web | where response_time > 500 | sort response_time | top 20

Question 5

A security analyst is analyzing web server logs and wants to produce a report of the five most frequently requested URI paths, but only for requests that returned a 404 status code, and the report must show the count for each path. Which TWO search commands are required to achieve the aggregation and the top-five limiting in this scenario? (Choose two.)

Accepted Answer

head 5. Producing a top-five report of URI paths with counts requires first aggregating events with stats count by uri_path, then sorting by count descending, and finally limiting with head 5. The two commands that perform the aggregation and the top-five limiting are stats and head. The top command could replace both in some designs, but the scenario asks for the commands required to perform aggregation and limiting in a pipeline.

Answer

top limit=5 uri_path

Answer

dedup uri_path

Answer

sort + count

Question 6

A compliance analyst needs to produce a report showing the number of events per sourcetype for each hour over the last 12 hours, with a separate column for each sourcetype. Which search command should be used?

Accepted Answer

index=main earliest=-12h | timechart span=1h count by sourcetype. The timechart command is specifically designed to create time-based charts with a column for each value of a split-by field. Using span=1h ensures hourly buckets, and count by sourcetype creates separate columns for each sourcetype. The other options either produce incorrect granularity, use an invalid syntax order, or do not create the required column-per-sourcetype structure.

Answer

index=main earliest=-12h | stats count by sourcetype, _time

Answer

index=main earliest=-12h | chart count by sourcetype over _time

Answer

index=main earliest=-12h | timechart count by sourcetype span=1h

Question 7

A SOC analyst needs to count how many events each user account generated in the last 24 hours and display only the five accounts with the highest counts. Which SPL search accomplishes this?

Accepted Answer

index=security earliest=-24h | stats count by user | sort 5 - count. Ranking accounts by event volume requires aggregation followed by ordering. The stats command collapses events into one row per user with a count field, and sort 5 - count then orders those rows from highest to lowest and keeps only five. This produces a clean result table containing exactly the user and count fields the analyst needs.

Answer

index=security earliest=-24h | top user limit=5

Answer

index=security earliest=-24h | stats count by user | head 5

Answer

index=security earliest=-24h | table user | dedup user | head 5

Question 8

A Splunk administrator is reviewing a dashboard that shows the number of failed login attempts per user over the last 24 hours. The search currently returns a table with the fields user and count. The administrator wants to rename the count field to failed_logins and display only users with more than five failed attempts. Which SPL search produces the desired output?

Accepted Answer

index=security sourcetype=auth earliest=-24h action=failure | stats count by user | rename count AS failed_logins | where failed_logins > 5. The stats command aggregates the failed attempts into a count field keyed by user. Renaming that field to failed_logins with rename makes the output more descriptive, and the where command then filters on the renamed field using a numeric comparison. Command order is essential: the rename must precede the where so the new field name exists when the filter is evaluated.

Answer

index=security sourcetype=auth earliest=-24h action=failure | rename count AS failed_logins | stats count by user | where failed_logins > 5

Answer

index=security sourcetype=auth earliest=-24h action=failure | stats count by user | rename count AS failed_logins | search failed_logins > 5

Answer

index=security sourcetype=auth earliest=-24h action=failure | stats count by user | where failed_logins > 5 | rename count AS failed_logins

Question 9

A SOC analyst wants to convert raw web access events into a table showing the average response time per HTTP status code, but only for status codes that appear more than 100 times. The events contain the fields status and response_time. Which search accomplishes this?

Accepted Answer

index=web | stats count avg(response_time) as avg_rt by status | where count > 100. To filter on an aggregated value such as event count, the aggregation must first be created by stats. Including count alongside avg(response_time) grouped by status makes count available for a downstream where clause, which correctly limits results to status codes with more than 100 events while preserving the average response time calculation.

Answer

index=web | top limit=100 status | stats avg(response_time) by status

Answer

index=web | stats avg(response_time) as avg_rt by status | search count > 100

Answer

index=web | stats avg(response_time) as avg_rt by status | where count > 100

Question 10

An analyst is writing a search that must reduce a large set of web events into a summary table of HTTP status codes and their average response times, then display only the ten slowest status codes. Which TWO SPL commands are required to build this result? (Choose two.)

Accepted Answer

sort 10 - avg(response_time). Summarizing events into per-status averages requires a transforming command that groups by status and calculates a mean, and then a sorting step that ranks those results and limits output. Together, the aggregation command and the limited descending sort produce the ten slowest status codes with their average response times, matching the requirement exactly.

Answer

dedup status

Answer

table status response_time

Answer

top status limit=10

Question 11

A Splunk user is analyzing web server logs and wants to produce a summary report. The user needs to group events by the status field and calculate the average response time, then sort the results so the highest average response time appears first. The user also wants to limit the output to the top 10 status codes. Which two SPL commands are required to achieve the grouping and aggregation, and then the ordering and limiting? (Choose two.)

Accepted Answer

stats avg(response_time) by status. The stats command performs the grouping and calculates the average response time per status. The resulting field is named avg_response_time, which is then sorted in descending order and limited to ten rows with sort and head. Together these commands produce the summarized, ordered, and limited report the user needs.

Answer

top limit=10 status by avg_response_time

Answer

eventstats avg(response_time) by status

Answer

dedup status | sort - avg_response_time

Question 12

A capacity planner needs a time-series report showing the count of login events per hour for the last seven days, with each hour represented as a separate column across the report. Which search produces this chart-ready output?

Accepted Answer

index=auth action=login earliest=-7d | timechart span=1h count. The timechart command aggregates events into time buckets and renders each bucket as a column, making it the appropriate transforming command for hourly time-series reporting. Specifying span=1h sets the bucket width to one hour, and the count function supplies the number of login events in each bucket across the seven-day window.

Answer

index=auth action=login earliest=-7d | stats count by _time

Answer

index=auth action=login earliest=-7d | chart count over _time

Answer

index=auth action=login earliest=-7d | timechart count by action span=1h

Question 13

A user wants to see the ten most recent events from the web index, with the newest event listed first, and no aggregation applied. Which search returns this result?

Accepted Answer

index=web | sort - _time | head 10. Returning the ten most recent events with the newest first requires an explicit ordering on the _time field. Sorting by _time in descending order places the latest events at the top, and limiting the output to ten rows with head delivers exactly the requested result set without invoking any transforming command.

Answer

index=web | reverse | head 10

Answer

index=web | head 10

Answer

index=web | stats count by _time | head 10

Question 14

A user wants to display the number of events per sourcetype in a bar chart. The user runs the search: index=web | stats count by sourcetype. However, the resulting visualization shows a table, not a bar chart. What should the user do to display the results as a bar chart?

Accepted Answer

Replace stats with chart: index=web | chart count by sourcetype. The chart command is designed to produce results in a format that is directly suitable for charting. While the stats command can also produce data that can be visualized as a bar chart, the chart command explicitly structures the output for that purpose. Replacing stats with chart ensures the data is aggregated and formatted correctly for a bar chart. The other options either add unnecessary commands, change the visualization type without ensuring data format, or use timechart which is for time-series data.

Answer

Change the visualization type in the Visualization tab to Bar Chart

Answer

Add the chart command after stats: | chart count by sourcetype

Answer

Use the timechart command instead: index=web | timechart count by sourcetype

Question 15

An analyst wants to calculate the average response time for each HTTP status code from web logs. The field `response_time` is numeric. Which SPL search will produce a table with each status code and its average response time?

Accepted Answer

index=web | stats avg(response_time) by status. The stats command with the avg function grouped by status is the standard way to calculate an average per category and present it as a table. Other commands like chart and timechart produce visualizations rather than tables, and sum would calculate totals instead of averages.

Answer

index=web | stats sum(response_time) by status

Answer

index=web | chart avg(response_time) over status

Answer

index=web | timechart avg(response_time) by status