SPLK-1001 Basic Searching and Transforming Commands Practice Test 7 — 15 Questions

Question 1

An analyst runs the search `index=web | stats count by status | sort - count` and wants to show only status codes with count greater than 100. Which command should be added before the sort?

Accepted Answer

where count>100. The `where` command is used to filter results based on a condition after statistical aggregation. In this search, `stats count by status` creates a field called `count`, and `where count>100` filters the results to show only status codes with a count greater than 100. The `where` command operates on the results of the `stats` command, making it the appropriate choice for post-aggregation filtering.

Answer

eval count>100

Answer

search count>100

Answer

filter count>100

Question 2

A team needs to calculate the average response time for each URL path from web server logs. The response time is in a field 'duration'. Which search is correct?

Accepted Answer

index=web | stats avg(duration) by url_path. The `stats avg(duration) by url_path` command computes the average of the 'duration' field for each distinct value of 'url_path', exactly matching the requirement to calculate average response time per URL path. The `stats` command with a `by` clause groups results by the specified field and applies the aggregation function to each group.

Answer

index=web | timechart avg(duration) by url_path

Answer

index=web | chart avg(duration) by url_path

Answer

index=web | eval avg_duration=avg(duration) | stats by url_path

Question 3

A search returns events with a field 'ip' that contains both IPv4 and IPv6 addresses. An analyst wants to count events for each IP type (IPv4 vs IPv6). Which command should be used to create a new field that categorizes the IP type?

Accepted Answer

eval. The `eval` command can create a new field by evaluating an expression, such as using the `if` function with `like()` or `match()` to test whether the IP address contains a colon (IPv6) or a dot (IPv4). This allows the analyst to categorize each event's IP type into a new field like `ip_type` without altering the original data.

Answer

fields

Answer

convert

Answer

rex

Question 4

A user wants to remove duplicate events based on the 'transaction_id' field, keeping only the first occurrence. Which command is appropriate?

Accepted Answer

dedup transaction_id. The `dedup` command removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the user wants to keep the first occurrence of each unique `transaction_id`, `dedup transaction_id` is the correct and simplest approach.

Answer

fields - transaction_id

Answer

sort transaction_id | dedup transaction_id

Answer

uniq transaction_id

Question 5

Which two of the following search commands are transforming commands? (Choose two.)

Accepted Answer

chart. In Splunk Search Processing Language (SPL), transforming commands are those that order the results into a data table for statistical/charting output, and both chart (D) and stats (E) are canonical transforming commands: chart aggregates events into a table of values arranged by a row (x-axis) and optional column split, while stats computes aggregations such as count, sum, avg, or dc grouped by one or more fields, producing tabular results. Because they convert raw events into a results table, they are the two transforming commands among the choices. The search command (A) is a non-transforming command that retrieves and filters events, eval (B) is a non-transforming command that calculates and assigns new fields to each event, and fields (C) is a non-transforming command that includes or excludes fields from results without aggregating them.

Answer

search

Answer

eval

Answer

fields

Question 6

Which three of the following are valid ways to filter events before a transforming command? (Choose three.)

Accepted Answer

Use the `eval` command to set a field and then `where` before the transforming command.. Option A is correct because you can use `eval` to compute or set a field and then apply `where` to filter events based on that field before the transforming command runs, effectively reducing the event set. Option D is correct because placing a search term in the initial search string filters events at search time, before any transforming command processes them. Option E is correct because the `search` command can be used mid-pipeline to filter events with keywords or field-value expressions before a transforming command. Option B is not correct because `fields` only includes or excludes fields from results; it does not filter events. Option C is not correct because `where` after a transforming command filters the transformed results, not the events before transformation.

Answer

Use the `fields` command to remove unwanted fields.

Answer

Use the `where` command after the transforming command.

Question 7

Refer to the exhibit. An analyst wants to see the top 10 most visited URI paths, but the result also includes a 'percent' column. To remove the percent column, which command should be added?

Accepted Answer

| fields - percent. The `fields` command with a minus sign removes specified fields from the results. Since the question asks to remove the 'percent' column, `| fields - percent` is the correct and most direct way to drop that field while keeping all other fields intact.

Answer

| table uri_path count

Answer

| eval percent=null()

Answer

| rename percent as ""

Question 8

A user wants to see the top 10 source IP addresses generating 404 errors. Which SPL is correct?

Accepted Answer

index=web status=404 | top src_ip. It first filters events with `index=web status=404` to isolate only 404 errors, then uses the `top` command to count occurrences of each `src_ip` value and return the top 10 by default. This directly answers the user's request for the top 10 source IPs generating 404 errors.

Answer

index=web status=404 | sort src_ip

Answer

index=web | top src_ip

Answer

index=web status=404 | rare src_ip

Question 9

An analyst runs: index=app sourcetype=log ERROR | stats count by host | where count > 5. What is the function of the where command in this search?

Accepted Answer

Filter the output of stats to show only hosts with count > 5. The `where` command filters the results of the `stats` calculation, keeping only rows where the `count` field exceeds 5. This is a post-processing filter applied after aggregation, not a pre-filter on raw events. The `where` command operates on the output of `stats`, not on the original events.

Answer

Remove duplicate hosts

Answer

Filter events that contain ERROR before counting

Answer

Rename the count field

Question 10

A user needs to create a report showing the average response time per endpoint for the last hour. Which command would produce this result?

Accepted Answer

stats avg(response_time) by endpoint. The `stats` command with `avg(response_time) by endpoint` calculates the average response time for each unique endpoint, which directly meets the requirement of showing average response time per endpoint for the last hour. The `stats` command is the standard way to compute aggregate statistics like average over grouped fields in Splunk.

Answer

chart avg(response_time) over endpoint

Answer

eval avg(response_time)

Answer

top endpoint

Question 11

A search returns many duplicate events due to data source redundancy. Which command can remove duplicate events based on a specific field?

Accepted Answer

dedup event_id. The `dedup` command removes duplicate events based on the values of one or more specified fields. In this case, `dedup event_id` will keep only the first occurrence of each unique `event_id` value, discarding subsequent duplicates. This is the correct command for removing duplicate events based on a specific field.

Answer

uniq event_id

Answer

fields event_id

Answer

sort event_id

Question 12

An analyst executes the following search: index=main sourcetype=access | stats dc(user) by host. What does dc(user) do?

Accepted Answer

Distinct count of users per host. The `dc(user)` function in SPL stands for 'distinct count' of the `user` field. When used after `stats ... by host`, it calculates the number of unique users associated with each host. This is why option B is correct: it returns the distinct count of users per host.

Answer

Count of hosts

Answer

Count of all users

Answer

Sum of user IDs

Question 13

Which THREE of the following are transforming commands in Splunk?

Accepted Answer

stats. The three transforming commands here are B. stats, C. timechart, and D. chart, because transforming commands take search results and reorganize them into a tabular format by aggregating events into statistical values grouped by fields. stats is the canonical transforming command: it calculates aggregates such as count, sum, avg, or dc and outputs a table of results grouped by a by-clause field. timechart is a transforming command that buckets events over time and produces a time-series table, with each row a time span and each column a split-by series. chart is likewise transforming, pivoting results into a table where one field supplies the x-axis and a split-by field supplies columns, with statistical values in the cells. The unmarked options do not belong: search is a generating/retrieval command that filters and returns raw events rather than transforming them into a statistical table, and eval is a streaming command that computes new fields per event without aggregating or restructuring results into a table.

Answer

search

Answer

eval

Question 14

Which TWO factors should be considered when deciding to use the rare command instead of top?

Accepted Answer

The dataset has high cardinality in the field of interest. Option A is correct because the rare command is designed to surface values that appear least often, so a field with high cardinality (many distinct values, each occurring infrequently) is exactly where rare provides value that top cannot, since top only shows the most common values. Option D is correct because the fundamental purpose of rare is to identify infrequent or unusual values, making the analysis goal of finding rare events the decisive factor in choosing rare over top. Option B is incorrect because rare is not inherently faster than top; both are Splunk transforming commands whose performance depends on the search, index, and time range, and rare often requires additional processing to sort ascending. Option C is incorrect because top is not always preferred for security analysis; rare is frequently used in security contexts to detect anomalous or low-frequency events. Option E is incorrect because neither rare nor top sorts results alphabetically by default; top sorts by frequency descending and rare sorts by frequency ascending, so alphabetical ordering is not a selection criterion.

Answer

Rare is faster than top

Answer

Top is always preferred for security analysis

Answer

The user wants to view results sorted alphabetically

Question 15

A security analyst uses Splunk to ingest firewall logs from multiple locations. The index is 'firewall' and the sourcetype is 'fw_log'. Each event contains fields: src_ip, dest_ip, action, bytes, and time. The analyst needs to find how many unique source IPs have been logged in the last hour to report potential scanning activity. The search should be efficient and accurate, returning only the total count of distinct source IPs. Which search accomplishes this?

Accepted Answer

index=firewall sourcetype=fw_log earliest=-1h | stats dc(src_ip) as UniqueIPs. It uses the `stats dc(src_ip)` command, which directly calculates the distinct count of source IPs in a single, efficient pass over the data. The `earliest=-1h` time filter restricts the search to the last hour, and the `as UniqueIPs` alias provides the exact output requested: a single number representing the total count of unique source IPs.

Answer

index=firewall sourcetype=fw_log earliest=-1h | dedup src_ip | stats count as UniqueIPs

Answer

index=firewall sourcetype=fw_log earliest=-1h | top src_ip | stats count as UniqueIPs

Answer

index=firewall sourcetype=fw_log | timechart dc(src_ip) span=1h