SPLK-1001 Basic Searching and Transforming Commands Practice Test 9 — 15 Questions

Question 1

A Splunk user runs a search that returns a large number of events. The user wants to display only the first 20 events sorted by the 'response_time' field in ascending order, and then show only the 'uri' and 'response_time' fields. Which sequence of SPL commands will accomplish this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

sort +response_time | head 20 | table uri, response_time. The correct sequence is to sort the full result set first, then limit to the first 20 events, and finally select the desired fields with table. Sorting before head ensures that the top 20 events are the ones with the lowest response times. Using head before sort would only sort a subset, which is not what the user wants.

Answer

sort -response_time | head 20 | table uri, response_time

Answer

head 20 | sort +response_time | table uri, response_time

Answer

table uri, response_time | sort +response_time | head 20

Question 2

An analyst wants to organize web events into 10-minute buckets and count them by status code, with each status code shown as its own column across the time buckets. Which search produces that layout directly?

Accepted Answer

index=web | timechart span=10m count by status. A time-series matrix with a column per status code is exactly what timechart produces. Setting span=10m creates the 10-minute buckets and the by status clause splits each bucket into separate status columns. Alternatives using stats or chart either return long-format rows or reverse the axes, and none combine correct time bucketing with the wide per-status column layout.

Answer

index=web | chart count over status by _time

Answer

index=web | stats count by status, date_minute

Answer

index=web | bin _time span=10m | stats count by _time, status

Question 3

A threat hunter needs to count events in the 'firewall' index grouped by both the 'src' and 'dest' fields, and then display only the combinations that occurred more than 100 times. Which SPL search accomplishes this?

Accepted Answer

index=firewall | stats count by src dest | where count > 100. Filtering on an aggregated value requires a two-stage pipeline: first compute the aggregate with a transforming command, then apply a condition to the resulting field. The stats command creates the count field grouped by source and destination, and the where command evaluates that calculated field against the numeric threshold. Row-limiting commands such as head cannot express a value-based condition.

Answer

index=firewall | stats count by src dest | head 100

Answer

index=firewall | stats count by src dest | search count > 100

Answer

index=firewall count > 100 | stats count by src dest

Question 4

A SOC analyst needs to build a quick pie chart showing the distribution of events per sourcetype over the last 24 hours. Which SPL search accomplishes this with a single transforming command?

Accepted Answer

index=main earliest=-24h | stats count by sourcetype. The stats command is transforming because it aggregates events into a summary table. Using stats count by sourcetype groups events by sourcetype and calculates a count for each group, which is exactly what a pie chart needs to show distribution. The other commands either filter fields or remove duplicates without aggregating, so they do not produce the required summary.

Answer

index=main earliest=-24h | table sourcetype

Answer

index=main earliest=-24h | dedup sourcetype

Answer

index=main earliest=-24h | fields sourcetype

Question 5

A security analyst wants to see the number of failed login attempts per user account for the past week, but only for accounts with more than 20 failures. Which SPL search returns exactly that?

Accepted Answer

index=security action=failure earliest=-7d | stats count by user | where count > 20. Filtering on an aggregated value requires the aggregation to run first. The stats command creates a count field for each user, and the where command then evaluates that field, keeping only rows where the count exceeds 20. Placing the filter before stats or using head instead of where cannot produce the correct threshold-based result.

Answer

index=security action=failure earliest=-7d | search count > 20 | stats count by user

Answer

index=security action=failure earliest=-7d | where count > 20 | stats count by user

Answer

index=security action=failure earliest=-7d | stats count by user | head 20

Question 6

An analyst has a base search that returns many events and wants the output sorted by the response_time field, largest value first, before reviewing the slowest requests. Which search returns the results in that order?

Accepted Answer

index=web | sort -response_time. Sorting results by a numeric field in descending order requires the sort command with a minus sign directly prefixed to the field name. That returns the largest response times first, which is what the analyst needs. Ascending sort, a space between the minus and the field, or the reverse command all fail to produce the required descending ranking by response_time.

Answer

index=web | reverse response_time

Answer

index=web | sort response_time

Answer

index=web | sort - response_time

Question 7

An analyst runs a search that returns thousands of events with a field named 'action'. They want to see only the count of each unique action value, sorted from highest to lowest count. Which SPL search achieves this?

Accepted Answer

index=web | top action. The top command is designed to return the most common values of a field along with their frequency and percentage, automatically sorted in descending order. Using top action directly produces the count of each unique action value sorted from highest to lowest. While stats count by action would also work, it is not among the options; stats count(action) without a by clause only returns a single total.

Answer

index=web | stats sum(action)

Answer

index=web | sort - action

Answer

index=web | stats count(action)

Question 8

A Splunk user wants to calculate the average response time for each HTTP status code from a web server log. The events contain fields 'status' and 'response_time'. Which search will produce a table with each status code and its average response time?

Accepted Answer

index=web | stats avg(response_time) by status. The stats command with the avg function and a by clause groups events by the specified field and calculates the average of the numeric field for each group. This produces a table with one row per status code and the average response time, which is the desired output. The other options either produce a chart, include a time dimension, or calculate the wrong statistic.

Answer

index=web | chart avg(response_time) over status

Answer

index=web | timechart avg(response_time) by status

Answer

index=web | stats sum(response_time) by status

Question 9

An analyst needs to compare the total number of successful and failed login events for each user over the last 7 days, and wants a single row per user with two separate columns: one for successes and one for failures. Which SPL search produces this output?

Accepted Answer

index=auth | stats count(eval(action="success")) as successes count(eval(action="failure")) as failures by user. Conditional counting with stats and the eval function is the standard way to produce multiple named count columns in one row per group. Grouping by user while computing count(eval(action="success")) and count(eval(action="failure")) yields a successes column and a failures column per user, giving the exact side-by-side comparison the analyst requested.

Answer

index=auth | chart count over user by action

Answer

index=auth | stats count by user action

Answer

index=auth | timechart span=7d count by action

Question 10

A security analyst wants to find the number of failed login attempts per user, but only for users who have more than 5 failures. Which SPL search is correct?

Accepted Answer

index=security action=failure | stats count by user | where count > 5. After aggregating with stats, you must use the where command to filter on the calculated count field. The where command evaluates arbitrary expressions, including numeric comparisons, on fields in the result set. Placing where after stats ensures the count field is available. Using search after stats does not work for numeric comparisons on aggregated fields, and placing where before stats fails because count does not exist yet.

Answer

index=security action=failure | stats count by user | filter count > 5

Answer

index=security action=failure | stats count by user | search count > 5

Answer

index=security action=failure | where count > 5 | stats count by user

Question 11

A SOC analyst needs to produce a quick report showing the total number of failed login events for each user account in the last 24 hours. The raw events contain a field named user and an action field. Which SPL search will return one row per user with the count of failed logins?

Accepted Answer

index=security action=failure | stats count by user. The stats command performs aggregation and is the standard way to count events grouped by a field. Filtering on action=failure before the pipe ensures only failed logins are counted, and count by user produces one row per user with the total. The other commands either display raw fields, rank values, or remove duplicates without counting.

Answer

index=security action=failure | dedup user

Answer

index=security action=failure | top user

Answer

index=security action=failure | table user, count

Question 12

A Splunk administrator needs to identify which commands in a search pipeline are transforming commands that will produce a tabular result set suitable for charting. Which two commands in the following list are transforming commands? (Choose two.)

Accepted Answer

timechart. Transforming commands aggregate events into a summary table. The chart and timechart commands are both transforming because they group and aggregate data, producing tabular results suitable for visualization. The eval, rex, and lookup commands are event-processing commands that operate on individual events without aggregating them, so they are not transforming.

Answer

lookup

Answer

rex

Answer

eval

Question 13

A Splunk administrator is building a dashboard panel and wants to display only the 20 most recent events from the index=web sourcetype=access_combined, with the newest event at the top of the panel. Which search accomplishes this?

Accepted Answer

index=web sourcetype=access_combined | sort - _time | head 20. Displaying the most recent events requires ordering by the _time field in descending order before limiting the result set. The sort - _time command places the newest events at the top, and head 20 then returns exactly 20 rows from that ordered set. Reversing the order of sort and head, or sorting ascending, produces the wrong events or the wrong sequence.

Answer

index=web sourcetype=access_combined | head 20 | sort - _time

Answer

index=web sourcetype=access_combined | sort _time | head 20

Answer

index=web sourcetype=access_combined | top limit=20 _time

Question 14

A network analyst needs to find the average response time per host for events in the last hour, and then display only the hosts whose average exceeds 500 milliseconds. Which SPL search accomplishes this?

Accepted Answer

index=network earliest=-1h | stats avg(response_time) as avg_rt by host | where avg_rt > 500. Aggregating first and filtering second is the correct order. The stats command computes an average response time per host and names it avg_rt, and the where command then applies the numeric threshold to that calculated field. Filtering before aggregation or referencing the original response_time field after aggregation cannot produce the desired hosts.

Answer

index=network earliest=-1h | where avg(response_time) > 500 | stats avg(response_time) by host

Answer

index=network earliest=-1h | stats avg(response_time) by host | where response_time > 500

Answer

index=network earliest=-1h | stats avg(response_time) as avg_rt by host | search avg_rt > 500

Question 15

An analyst needs to add a new field named 'duration_seconds' to every event by dividing the existing 'duration_ms' field by 1000, without removing any other fields or changing the number of events returned. Which SPL search accomplishes this?

Accepted Answer

index=app | eval duration_seconds = duration_ms / 1000. Adding a calculated field to every event without altering the event count requires eval, which evaluates an arithmetic expression per event and writes the result into a new field. The other commands either aggregate events into fewer rows, extract text with pattern matching, or merely relabel an existing field. Only eval performs the division while preserving all original fields and rows.

Answer

index=app | rex field=duration_ms "(?<duration_seconds>.*)"

Answer

index=app | stats sum(duration_ms) as duration_seconds

Answer

index=app | rename duration_ms as duration_seconds