SPLK-1001 Basic Searching and Transforming Commands — Timed 10 Questions

Question 1

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

Accepted Answer

| stats count by status | where count > 100. It uses `stats count by status` to count events per status code, creating a field named 'count', then filters with `where count > 100`. Option C is also correct, achieving the same result by renaming the count field to 'cnt' before filtering. Both follow the standard Splunk pipeline pattern of aggregating then filtering. Options B and D are incorrect: B uses an unnecessary `eval` and `sum(count)` which is inefficient; D places `where count > 100` before `stats`, so `count` does not exist yet, causing an error or no filtering.

Answer

| eval count=1 | stats sum(count) by status | where count > 100

Answer

| where count > 100 | stats count by status

Question 2

An analyst wants to remove duplicate events based on the 'user' field, keeping only the first occurrence. Which command should be used?

Accepted Answer

| dedup user. The `dedup` command in Splunk removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the analyst wants to remove duplicates based on the 'user' field and retain the first event, `| dedup user` is the correct command.

Answer

| sort -user

Answer

| uniq user

Answer

| fields user

Question 3

How many events will be output by this search?

Accepted Answer

3. The total number of events before the dedup command (not shown) is 15, but dedup on a field with only 3 unique values reduces the output to 3 events.

Answer

15

Answer

5

Answer

1

Question 4

What is the purpose of this search?

`index=web | top limit=5 status`

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The stem does not include the search query, but based on the options, the correct answer is C because it is the only option that describes a valid outcome of a search using the `top` command to find the most common HTTP status codes. Options A, B, and D are incorrect as they describe sorting or filtering behaviors that are not standard for a single search without additional commands.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 5

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. It filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 6

Which three of the following are valid uses of the `stats` command in Splunk? (Choose three.)

Accepted Answer

Finding the earliest timestamp of events grouped by a field using `earliest(field)`. The `stats` command in Splunk is used to perform statistical aggregations on search results. `count(field)` counts the number of events where the specified field exists, `avg(field)` calculates the mean of a numeric field, and `earliest(field)` returns the earliest (oldest) timestamp value for that field within each group. These are all valid aggregation functions that operate on field values across events.

Answer

Removing duplicate events based on a field using `dedup` inside the stats command

Answer

Sorting results in descending order directly within the stats command

Answer

Joining two separate searches into a single stats output

Question 7

Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)

Accepted Answer

It supports conditional logic using the `if` function. The `eval` command in Splunk is used to create new fields by evaluating expressions. It supports conditional logic with the `if` function (true for C). It can evaluate mathematical expressions like `eval x = y + 1` (true for F). However, it does not rename fields (B), modify raw indexed data (D), or combine strings using the `+` operator; string concatenation in Splunk eval uses the `.` operator or `concat` function (E is false).

Answer

It modifies the original raw data stored in the index

Answer

It can be used to rename fields in the search results

Answer

It can be used to calculate mathematical expressions like `eval x = y + 1`

Question 8

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Accepted Answer

The `rare` command returns the least common values of a field based on count.. The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. Importantly, by default, `top` and `rare` include events with null or empty values for the specified field as a separate value, rather than removing them automatically. Therefore, statement D is incorrect. Statements E and F are also false: `rare` can be used on any field, not just regex-extracted; and both commands have default limits (10 results) so the `limit` argument is optional.

Answer

Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Answer

The `rare` command can only be used on fields that have been extracted using regex.

Question 9

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Accepted Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.. Forwarder setup requires installation, configuration of output and input settings, restart, and verification.

Answer

Install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Answer

Install the Splunk Universal Forwarder, then configure outputs.conf to point to the indexer, then restart the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then verify that data is being forwarded to the indexer.

Answer

Configure outputs.conf to point to the indexer, then install the Splunk Universal Forwarder, then configure inputs.conf to define data sources, then restart the Splunk Universal Forwarder, then verify that data is being forwarded to the indexer.

Question 10

Match each Splunk role to its typical permission scope.

Accepted Answer

User: Can search and create reports, but cannot modify system settings.. In Splunk, the User role has basic search and reporting capabilities without system changes, Power User adds knowledge object creation, and Admin has full system and user management access.

Answer

User: Can manage user accounts.

Answer

Power User: Has full access to system configuration.

Answer

Admin: Can search and create reports but cannot modify system settings.