SPLK-1001 Basic Searching and Transforming Commands Practice Test 6 — 15 Questions

Question 1

A Splunk user needs to identify the top 3 source IP addresses generating the most failed login events. Which two SPL searches will produce a result showing the top 3 source IPs and their counts? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

index=security action=failure | top limit=3 src_ip. The top command with limit=3 directly returns the top 3 source IPs and their counts. Alternatively, using stats with count by src_ip, sorting descending by count, and taking the first 3 also produces the same result. Both are valid and efficient ways to meet the requirement.

Answer

index=security action=failure | top src_ip | head 3

Answer

index=security action=failure | rare limit=3 src_ip

Answer

index=security action=failure | stats count by src_ip | sort count | head 3

Question 2

A Splunk analyst runs a search that returns events with a numeric field `bytes`. They want to calculate the total bytes transferred per `host`, but also include a column showing the percentage of total bytes each host contributed. Which SPL search will produce this result?

Accepted Answer

index=network | stats sum(bytes) as total_bytes by host | eventstats sum(total_bytes) as grand_total | eval percent=round(total_bytes/grand_total*100,2) | table host total_bytes percent. The correct search uses stats to sum bytes per host, then eventstats to compute the grand total, and eval with round to calculate a clean percentage. This produces the required table with host, total bytes, and percentage. The other options either use incorrect commands or omit rounding, which is expected for percentage calculations.

Answer

index=network | stats sum(bytes) as total_bytes by host | eventstats sum(total_bytes) as grand_total | eval percent=total_bytes/grand_total*100 | table host total_bytes percent

Answer

index=network | stats sum(bytes) as total_bytes by host | top total_bytes

Answer

index=network | stats sum(bytes) as total_bytes by host | addtotals | eval percent=total_bytes/Total*100 | table host total_bytes percent

Question 3

A security analyst needs to identify the top 5 source IP addresses generating the most web traffic. Which command should be used?

Accepted Answer

| top limit=5 src_ip. The `top` command is specifically designed to return the most common values of a field, and `limit=5` restricts the output to the top 5 source IP addresses by count. This command automatically sorts the results in descending order, making it the most efficient and direct way to identify the top 5 source IPs generating web traffic.

Answer

| stats count by src_ip | sort - count

Answer

| sort - count | head 5

Answer

| table src_ip | head 5

Question 4

A search returns events with a field 'duration' in milliseconds. The analyst wants to create a new field 'duration_sec' that divides duration by 1000. Which command accomplishes this?

Accepted Answer

| eval duration_sec = duration / 1000. The `eval` command in Splunk is specifically designed to create new fields by evaluating expressions, including arithmetic operations. Using `| eval duration_sec = duration / 1000` creates a new field `duration_sec` that contains the value of `duration` divided by 1000, converting milliseconds to seconds.

Answer

| rename duration as duration_sec

Answer

| convert duration_sec = duration/1000

Answer

| fields duration_sec = duration/1000

Question 5

A search returns 1,000 events. The analyst wants to see the first 10 events sorted by the '_time' field in descending order. Which search is correct?

Accepted Answer

| sort -_time | head 10. The `sort` command with a hyphen prefix (`-`) sorts in descending order. By default, `sort` sorts in ascending order, so `sort -_time` sorts events by the `_time` field from newest to oldest, and `head 10` returns the first 10 events, which are the 10 most recent.

Answer

| sort by _time | head 10

Answer

| sort +_time | head 10

Answer

| sort _time | head 10

Question 6

A search includes the command '| stats dc(user) by host'. What does this command return?

Accepted Answer

The number of distinct users per host. The `dc(user)` function in the `stats` command calculates the distinct count of the `user` field values. When combined with `by host`, it returns the number of unique users for each host. This is why option D is correct.

Answer

The number of unique hosts per user

Answer

The count of events per host

Answer

The sum of user values per host

Question 7

Which TWO commands can be used to filter events based on a field value? (Choose two.)

Accepted Answer

search. The search command (B) filters events by matching keywords and field-value expressions against the raw event data, so a clause like `search status=404` returns only events whose status field equals 404. The where command (D) filters events by evaluating a Boolean expression against extracted fields, so `where status=404` keeps only events where that field comparison is true. The eval command (A) is used to calculate or assign new field values, not to filter events. The stats command (C) aggregates events into summary results rather than filtering individual events by a field value. The table command (E) only formats and displays selected fields in a tabular output and does not filter events.

Answer

eval

Answer

stats

Answer

table

Question 8

Which THREE of the following are valid uses of the 'eval' command? (Choose three.)

Accepted Answer

Concatenating two strings: eval fullname = firstname + " " + lastname. Option B is correct because eval can compute a new field using string concatenation with the + operator, so eval fullname = firstname + " " + lastname joins the two string fields with a space. Option D is correct because eval supports arithmetic expressions, so eval ratio = count / total derives a new field by dividing two numeric values. Option E is correct because eval supports conditional functions such as if(), so eval status = if(error > 0, "Error", "OK") creates a field whose value depends on the error count. Option A is not a valid eval use because grouping is done with the by clause of transforming commands like stats or chart, not with eval. Option C is not a valid eval use because sorting is performed by the sort command, not by eval.

Answer

Grouping events by a field: eval by host

Answer

Sorting events by a field: eval sort by _time

Question 9

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Accepted Answer

The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.. Option A is correct because the stats command is Splunk's primary aggregation command, computing summary statistics such as count, sum, avg, min, max, dc (distinct count), and many other statistical functions over the result set. Option E is correct because stats supports a by clause (e.g., `stats count by host`) to group results by one or more fields, and those by fields must already exist in the search results for the grouping to work. Option B is incorrect because listing individual events is the job of commands like table or raw event display, not stats, which collapses events into aggregated rows. Option C is incorrect because creating new fields is done with eval, not stats, which only aggregates existing fields. Option D is incorrect because stats works with non-numeric fields too, for example count, dc, values, and list operate on string fields.

Answer

The `stats` command displays a list of individual events with their fields.

Answer

The `stats` command is used to create new fields using the `eval` function.

Answer

The `stats` command can only be used with numeric fields.

Question 10

Refer to the exhibit. A security analyst runs the search and sees the result table. The analyst wants to see only the top 3 URI paths with their counts, without the percentage column. Which command modification achieves this?

Accepted Answer

`index=web sourcetype=access_combined | top limit=3 showperc=f uri_path`. The `top` command's `showperc=f` argument suppresses the percentage column, and `limit=3` restricts the output to the top 3 URI paths. This directly meets the requirement of showing only the top 3 URI paths with their counts, without the percentage column.

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path | fields - percent`

Answer

`index=web sourcetype=access_combined | top uri_path | head 3`

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path`

Question 11

A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?

Accepted Answer

Rewrite the search as `index=main error | stats count by host`.. The original search uses a pipe to the `search` command, which forces Splunk to retrieve all events from the index and then filter them in the search head, causing unnecessary I/O and CPU load. By rewriting the search as `index=main error`, the keyword `error` becomes part of the initial search string, allowing Splunk to use its index-time and search-time optimizations (e.g., inverted index lookups, bloom filters) to retrieve only matching events from disk, dramatically reducing the data scanned and improving performance without altering results.

Answer

Use the `transaction` command to group related events before counting.

Answer

Replace `stats count by host` with `top limit=5 host` to limit output.

Answer

Add a `summarize` command before `stats` to pre-aggregate data.

Question 12

Drag and drop the steps to create a Splunk dashboard with a single panel into the correct order.

Accepted Answer

Execute search, then Save As > Dashboard Panel, then select or create dashboard, then configure panel settings.. The correct sequence for creating a Splunk dashboard with a single panel is to first execute a search, then save it as a dashboard panel (not as a report), select or create the dashboard, and finally configure the panel settings. This ensures the panel is directly linked to the search and properly placed in the dashboard.

Answer

Create dashboard first, then execute search, then add panel to dashboard, then configure panel settings.

Answer

Execute search, then Save As > Report, then add report to dashboard as panel, then configure panel settings.

Answer

Add panel to dashboard first, then execute search, then save results, then configure panel settings.

Question 13

A search uses `eval memory_MB = memory_bytes / 1024 / 1024`. The field memory_bytes contains values like '2,048,000'. The eval results memory_MB is often null. What is the most likely cause?

Accepted Answer

The field is actually a string with commas.. The `memory_bytes` field contains values like '2,048,000', which include commas. In Splunk, fields with commas are treated as strings, not numeric values. When `eval` attempts arithmetic division on a string field, it returns null because the operation cannot be performed on non-numeric data. The commas must be removed (e.g., using `replace` or `tonumber`) before the field can be used in calculations.

Answer

The eval command has a syntax error.

Answer

The field needs to be converted first.

Answer

The division operator does not work on string fields.

Question 14

Which THREE of the following are valid uses of the stats command?

Accepted Answer

stats avg(response_time) as avg_time. Option B is correct because stats supports statistical aggregation functions such as avg() with an optional as clause to rename the resulting field, so stats avg(response_time) as avg_time is a valid use. Option C is correct because stats sum(bytes) by source applies the sum() aggregation function grouped by the source field, which is a standard stats usage. Option D is correct because stats count by host uses the count aggregation function with a by clause to group results by host, a canonical stats pattern. Option A is not valid because eval() is not an aggregation function and cannot be used inside stats; eval is a separate command for calculating expressions. Option E is not valid because table is a separate command, not a stats function, so stats table user is not a legitimate stats invocation.

Answer

stats eval(x=1) by category

Answer

stats table user

Question 15

A user wants to see the top 5 most common values of the 'action' field in the web access logs. Which command should be used?

Accepted Answer

top. The `top` command is designed to find the most frequent values of a field. By default, it returns the top 10 results, but you can specify `limit=5` to get the top 5 most common values of the 'action' field in web access logs.

Answer

rare

Answer

fields

Answer

sort