SPLK-1001 Basic Searching and Transforming Commands Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. A Splunk analyst wants to find the top users generating syslog events. If the analyst wants to include all users, not just the top 5, which command modification is correct?

Accepted Answer

Change to stats count by user. The `top` command returns the most common values up to a limit (default 10). Removing `limit=5` restores the default limit of 10, but still does not include all users. In contrast, `stats count by user` counts events for each user without any limit, thereby including all users. Therefore, option B is the correct modification to include all users.

Answer

Replace top with rare

Answer

Add useother=t

Answer

Remove limit=5

Question 2

Refer to the exhibit. A data analyst is analyzing web traffic and wants to find the most accessed products. The rex command extracts product IDs from URI paths. Why might the top command return inaccurate results?

Accepted Answer

Events without matching product IDs will be counted as a single value. The `top` command counts all events, including those where the `rex` command failed to extract a product ID. Such events have a null value for the extracted field, and `top` groups all null values together as a single category, often resulting in 'null' appearing as the top value, thus skewing the results. This is a common pitfall when using `rex` before `top`.

Answer

The regex pattern is incorrect

Answer

The limit should be 0 to show all

Answer

The top command is not sorted

Question 3

A Splunk administrator needs to identify the three slowest-performing web transactions from the past hour. The transactions are logged in the 'web_logs' index with a numeric field named 'response_time_ms'. The administrator runs the search 'index=web_logs earliest=-1h | top response_time_ms limit=3' but the results show incorrect counts instead of the transactions with the highest response times. Which search should the administrator use instead?

Accepted Answer

index=web_logs earliest=-1h | sort - response_time_ms | head 3. To find the slowest individual transactions, you must sort events by the numeric response time in descending order and then limit to the top three. The sort command orders events, and head returns the first N. Using top or rare would count field values instead of ranking events, which does not satisfy the requirement.

Answer

index=web_logs earliest=-1h | rare response_time_ms limit=3

Answer

index=web_logs earliest=-1h | top limit=3 response_time_ms

Answer

index=web_logs earliest=-1h | stats max(response_time_ms) as max_time by transaction_id | sort - max_time | head 3

Question 4

A Splunk administrator needs to display the 10 most recent authentication failures from the past 24 hours, sorted from newest to oldest. Which SPL search accomplishes this?

Accepted Answer

index=security sourcetype=auth action=failure earliest=-24h | sort -_time | head 10. The correct search must filter events, sort them in descending time order, and then limit to 10. Sorting must occur before limiting to ensure the most recent events are selected. Using head after sort -_time achieves this. The other options either limit before sorting, use a transforming command that does not return raw events, or sort in the wrong direction.

Answer

index=security sourcetype=auth action=failure earliest=-24h | sort _time | tail 10

Answer

index=security sourcetype=auth action=failure earliest=-24h | head 10 | sort -_time

Answer

index=security sourcetype=auth action=failure earliest=-24h | top 10 action

Question 5

A junior Splunk user is analyzing HTTP status codes in the 'web' index. The user runs the search 'index=web | stats count by status' and sees a table with status codes and their counts. The user now wants to display only the status codes that have a count greater than 100. Which search should the user run?

Accepted Answer

index=web | stats count by status | where count > 100. After using stats to calculate counts, the where command is the correct way to filter results based on a numeric condition. It evaluates the expression for each result row and keeps only those that match. The search command cannot handle comparison operators, filter is not a valid command, and eval does not filter rows.

Answer

index=web | stats count by status | filter count > 100

Answer

index=web | stats count by status | eval count > 100

Answer

index=web | stats count by status | search count > 100

Question 6

A security analyst needs to create a report that shows the average response time for each HTTP method (GET, POST, etc.) over the last 24 hours. The data is in the 'web' index with fields 'method' and 'response_time'. The analyst wants the results sorted with the highest average response time first. Which search should the analyst use?

Accepted Answer

index=web earliest=-24h | stats avg(response_time) as avg_rt by method | sort - avg_rt. To calculate the average response time per HTTP method and sort descending, use stats avg() with a by clause to group by method, rename the result for clarity, and then sort with a '-' prefix to order from highest to lowest. The other options either sort ascending, use a command that produces a different structure, or reference a non-existent field.

Answer

index=web earliest=-24h | chart avg(response_time) over method | sort - avg_rt

Answer

index=web earliest=-24h | stats avg(response_time) as avg_rt by method | sort avg_rt

Answer

index=web earliest=-24h | timechart avg(response_time) by method | sort - avg_rt

Question 7

A Splunk administrator needs to identify the total license volume consumed by each index over the last 24 hours. The administrator runs a search that reports the sum of raw event bytes grouped by index. Which SPL command must be used to calculate the sum of bytes for each index?

Accepted Answer

stats sum(bytes) AS total_bytes BY index. The stats command is the correct choice because it performs aggregations such as sum() and can group results by a field like index. This produces one row per index with the total bytes, which directly answers the license volume question. Other commands either add fields to events or return frequency counts, not sums.

Answer

eventstats sum(bytes) AS total_bytes BY index

Answer

top bytes BY index

Answer

transaction bytes BY index

Question 8

A security analyst needs to quickly see which five source IP addresses generated the most failed login events over the past 24 hours. The analyst wants a table that shows each source IP and its count, sorted with the highest count first. Which SPL search accomplishes this?

Accepted Answer

index=security action=failure | top limit=5 src_ip. The top command is the correct tool because it is a transforming command that aggregates events by a field and returns the most frequent values with counts, already sorted from highest to lowest. Adding limit=5 caps the result at the five most common source IP addresses, giving the analyst an immediate ranked view of the busiest failed-login origins.

Answer

index=security action=failure | stats count by src_ip | head 5

Answer

index=security action=failure | sort - count | table src_ip count

Answer

index=security action=failure | rare src_ip

Question 9

A SOC analyst needs to quickly view the 15 slowest web transactions from the last hour in the 'web' index. The events already contain a numeric field named 'response_ms'. Which SPL search returns exactly the 15 events with the highest 'response_ms' values, sorted from slowest to fastest?

Accepted Answer

index=web earliest=-1h | sort - response_ms | head 15. To retrieve the slowest transactions, the events must first be ordered by the response_ms field in descending order and then truncated to the desired count. The minus sign reverses the default ascending sort, and head keeps only the first rows of that ordered stream. Aggregating commands such as top answer a different question because they count occurrences rather than rank numeric magnitude.

Answer

index=web earliest=-1h | sort response_ms | head 15

Answer

index=web earliest=-1h | head 15 | sort - response_ms

Answer

index=web earliest=-1h | top response_ms limit=15

Question 10

A security analyst wants to find the number of failed login attempts for each user account in the last hour. The analyst needs a report that shows each user and the count of failed logins, sorted with the highest count first. Which SPL command should be used to calculate the count of failed logins per user?

Accepted Answer

stats count BY user. The stats command with count BY user is the correct approach because it aggregates events by the user field and returns the number of events for each user. This gives a clear report of failed login counts per user. Other commands either remove duplicates or show only extremes, not the full count per user.

Answer

rare user

Answer

top user

Answer

dedup user

Question 11

An analyst needs to display the top 5 values of the 'action' field from a set of web proxy events, along with the count and percentage for each value. The events are already retrieved by a base search. Which command should be added to the search to achieve this?

Accepted Answer

top limit=5 action. The top command is specifically designed to return the most common values of a field along with their count and percentage. Using limit=5 restricts the output to the top 5 values. The other commands either do not limit to top values, return the least common values, or do not aggregate by the field to produce counts and percentages.

Answer

rare limit=5 action

Answer

sort - count | head 5

Answer

stats count by action

Question 12

An analyst runs a search that returns thousands of web access events. The analyst wants to produce a report showing the average response time for each HTTP status code, but only for status codes that appear more than 100 times. Which SPL search produces this result?

Accepted Answer

index=web | stats avg(response_time) as avg_rt count by status | where count > 100. To filter on an aggregated value, the aggregation must first exist in the pipeline. Using stats avg(response_time) as avg_rt count by status creates both the average and the per-status event count, and the subsequent where count > 100 keeps only status codes meeting the frequency threshold. This ordering is what makes the filter valid and the report correct.

Answer

index=web | stats avg(response_time) as avg_rt by status | where count > 100

Answer

index=web | stats avg(response_time) as avg_rt by status | search count > 100

Answer

index=web | where count > 100 | stats avg(response_time) as avg_rt by status

Question 13

A SOC analyst searches web logs and gets a count for every status code, including rare ones like 418 and 000. The analyst wants to display only the three most frequently occurring status codes. Which search accomplishes this?

Accepted Answer

index=web | top limit=3 status. The top command is purpose-built to rank a field by frequency and limit the output, so top limit=3 status returns the three most common status codes with their counts and percentages. Approaches that aggregate first and then limit rows depend on ordering that is not guaranteed, and they can display arbitrary values instead of the genuinely most frequent ones.

Answer

index=web | stats count by status | top 3 status

Answer

index=web | stats count by status | sort count | tail 3

Answer

index=web | stats count by status | head 3

Question 14

A Splunk administrator is troubleshooting authentication failures in the 'auth' index. The events contain a field named 'action' with values such as 'success', 'failure', and 'logout'. The administrator wants a single result row showing the total number of events for each distinct value of 'action'. Which SPL search produces that output?

Accepted Answer

index=auth | stats count by action. Grouped totals in Splunk are produced with a transforming command that accepts a by clause. Using stats with the count function and grouping by the action field collapses the event stream into one row per distinct action value, which directly answers how many successes, failures, and logouts occurred. Commands that merely filter, deduplicate, or display fields cannot create new aggregate values.

Answer

index=auth | table action count

Answer

index=auth | fields action | count

Answer

index=auth | dedup action

Question 15

A security analyst needs to find all events in the last 24 hours where the 'status' field is either 'failed' or 'error'. The analyst writes: index=security status=failed OR error. The search returns events with status='failed' but also events where the word 'error' appears anywhere in the raw event, including in unrelated fields. What is the best way to correct the search to return only events where the 'status' field is exactly 'failed' or 'error'?

Accepted Answer

index=security status=failed OR status=error. To restrict results to events where the status field matches specific values, each value must be explicitly associated with the field name. Using 'status=failed OR status=error' ensures that only events with those exact field values are returned, eliminating false positives from the term 'error' appearing elsewhere in the raw event data.

Answer

index=security status=failed OR status=error NOT status=success

Answer

index=security status=failed OR error

Answer

index=security status IN (failed, error)