SPLK-1002 Basic Searching and Transforming Commands — Timed 20 Questions

Question 1

A security analyst needs to identify the top 5 source IP addresses generating the most web traffic. Which command should be used?

Accepted Answer

| top limit=5 src_ip. Option B is correct because the `top` command is specifically designed to return the most common values of a field, and `limit=5` restricts the output to the top 5 source IP addresses by count. This command automatically sorts the results in descending order, making it the most efficient and direct way to identify the top 5 source IPs generating web traffic.

Answer

| stats count by src_ip | sort - count

Answer

| sort - count | head 5

Answer

| table src_ip | head 5

Question 2

An administrator wants to count events by status code and show only codes with more than 100 events. Which search correctly accomplishes this?

Accepted Answer

| stats count as cnt by status | where cnt > 100. Option C is correct because it first uses `stats count as cnt by status` to count events per status code, renaming the count field to `cnt`, then applies `where cnt > 100` to filter for status codes with more than 100 events. This is the standard Splunk pattern for aggregating data and then filtering on the aggregated result.

Answer

| stats count by status | where count > 100

Answer

| eval count=1 | stats sum(count) by status | where count > 100

Answer

| where count > 100 | stats count by status

Question 3

A search returns events with a field 'duration' in milliseconds. The analyst wants to create a new field 'duration_sec' that divides duration by 1000. Which command accomplishes this?

Accepted Answer

| eval duration_sec = duration / 1000. Option C is correct because the `eval` command in Splunk is specifically designed to create new fields by evaluating expressions, including arithmetic operations. Using `| eval duration_sec = duration / 1000` creates a new field `duration_sec` that contains the value of `duration` divided by 1000, converting milliseconds to seconds.

Answer

| rename duration as duration_sec

Answer

| convert duration_sec = duration/1000

Answer

| fields duration_sec = duration/1000

Question 4

A search returns 1,000 events. The analyst wants to see the first 10 events sorted by the '_time' field in descending order. Which search is correct?

Accepted Answer

| sort -_time | head 10. Option B is correct because the `sort` command with a hyphen prefix (`-`) sorts in descending order. By default, `sort` sorts in ascending order, so `sort -_time` sorts events by the `_time` field from newest to oldest, and `head 10` returns the first 10 events, which are the 10 most recent.

Answer

| sort by _time | head 10

Answer

| sort +_time | head 10

Answer

| sort _time | head 10

Question 5

An analyst wants to remove duplicate events based on the 'user' field, keeping only the first occurrence. Which command should be used?

Accepted Answer

| dedup user. The `dedup` command in Splunk removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the analyst wants to remove duplicates based on the 'user' field and retain the first event, `| dedup user` is the correct command.

Answer

| sort -user

Answer

| uniq user

Answer

| fields user

Question 6

A search includes the command '| stats dc(user) by host'. What does this command return?

Accepted Answer

The number of distinct users per host. The `dc(user)` function in the `stats` command calculates the distinct count of the `user` field values. When combined with `by host`, it returns the number of unique users for each host. This is why option D is correct.

Answer

The number of unique hosts per user

Answer

The count of events per host

Answer

The sum of user values per host

Question 7

Which TWO commands can be used to filter events based on a field value? (Choose two.)

Accepted Answer

search. The `search` command is the primary way to filter events in Splunk, and it can be used to filter based on field values using syntax like `field=value`. The `where` command evaluates Boolean expressions and is specifically designed to filter results based on field values, supporting comparisons, wildcards, and functions. Both commands directly filter events by evaluating field values.

Answer

eval

Answer

stats

Answer

table

Question 8

Which THREE of the following are valid uses of the 'eval' command? (Choose three.)

Accepted Answer

Concatenating two strings: eval fullname = firstname + " " + lastname. Option B is correct because the 'eval' command can concatenate strings using the plus (+) operator, as shown in the example 'eval fullname = firstname + " " + lastname'. This creates a new field 'fullname' by combining the values of 'firstname', a space, and 'lastname'.

Answer

Grouping events by a field: eval by host

Answer

Sorting events by a field: eval sort by _time

Question 9

How many events will be output by this search?

Accepted Answer

3. The search uses the `dedup` command with a field name, which removes duplicate events based on that field. With 15 total events but only 3 unique values in the specified field, `dedup` keeps the first occurrence of each unique value, outputting exactly 3 events.

Answer

15

Answer

5

Answer

1

Question 10

What is the purpose of this search?

Accepted Answer

To display the 5 most common HTTP status codes in the web index.. The search uses `top` to find the most common values in the `status` field, limited to 5 results. The `top` command counts occurrences and sorts by count descending, so it returns the 5 most frequent HTTP status codes from the web index. Option C correctly describes this behavior.

Answer

To list the first 5 status codes in alphabetical order.

Answer

To filter events with status codes that appear less than 5 times.

Answer

To show the 5 most recent events sorted by status code.

Question 11

A large e-commerce company uses Splunk to monitor their web application. The operations team has noticed that the search for tracking user sessions is taking too long and consuming excessive resources. The current search is:

index=web sourcetype=access_combined
| stats count by clientip, sessionid, productid
| sort - count

The index contains over 10 billion events per day. The team wants to reduce the search time while still being able to identify the top 10 most active sessions (combinations of clientip and sessionid) that involve more than 5 product views. They also need to exclude any sessions that originated from internal IPs (10.0.0.0/8). Which approach would achieve this most efficiently?

Accepted Answer

Add 'clientip!=10.0.0.0/8' in the base search, then use 'stats count by clientip, sessionid', then 'where count>5', then 'sort - count | head 10'.. Option D is correct because it filters out internal IPs early in the base search using `clientip!=10.0.0.0/8`, which reduces the dataset before any transformation. It then uses `stats count by clientip, sessionid` to aggregate sessions, applies `where count>5` to enforce the minimum product views, and finally sorts and limits to the top 10. This approach minimizes resource consumption by pushing filtering as early as possible and avoids unnecessary fields like `productid`.

Answer

Use 'eventstats count by clientip, sessionid' and then filter where count > 5, then sort and head.

Answer

Use the 'transaction' command to group events by clientip and sessionid, then filter by duration.

Answer

Add a 'where' command after stats to filter out internal IPs and use 'head 10' at the end.

Question 12

Which TWO of the following statements about the `stats` command in Splunk are correct? (Choose two.)

Accepted Answer

The `stats` command is used to compute summary statistics such as count, sum, avg, and distinct count.. Option A is correct because the `stats` command in Splunk is specifically designed to compute summary statistics like count, sum, avg, and distinct count over a set of events. It transforms raw event data into aggregated results, making it a core transforming command for reporting and analysis.

Answer

The `stats` command displays a list of individual events with their fields.

Answer

The `stats` command is used to create new fields using the `eval` function.

Answer

The `stats` command can only be used with numeric fields.

Question 13

Refer to the exhibit. A security analyst runs the search and sees the result table. The analyst wants to see only the top 3 URI paths with their counts, without the percentage column. Which command modification achieves this?

Accepted Answer

`index=web sourcetype=access_combined | top limit=3 showperc=f uri_path`. Option C is correct because the `top` command's `showperc=f` argument suppresses the percentage column, and `limit=3` restricts the output to the top 3 URI paths. This directly meets the requirement of showing only the top 3 URI paths with their counts, without the percentage column.

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path | fields - percent`

Answer

`index=web sourcetype=access_combined | top uri_path | head 3`

Answer

`index=web sourcetype=access_combined | top limit=3 uri_path`

Question 14

A junior Splunk user is tasked with investigating slow search performance in a large Splunk environment. The user runs a search over a week of data from the main index (containing 500 GB of data per day) using the following command: `index=main | search error | stats count by host`. The search takes over 10 minutes to complete. The user wants to improve search performance while still getting accurate results. Which of the following actions should the user take first?

Accepted Answer

Rewrite the search as `index=main error | stats count by host`.. Option D is correct because the original search uses a pipe to the `search` command, which forces Splunk to retrieve all events from the index and then filter them in the search head, causing unnecessary I/O and CPU load. By rewriting the search as `index=main error`, the keyword `error` becomes part of the initial search string, allowing Splunk to use its index-time and search-time optimizations (e.g., inverted index lookups, bloom filters) to retrieve only matching events from disk, dramatically reducing the data scanned and improving performance without altering results.

Answer

Use the `transaction` command to group related events before counting.

Answer

Replace `stats count by host` with `top limit=5 host` to limit output.

Answer

Add a `summarize` command before `stats` to pre-aggregate data.

Question 15

Which three of the following are valid uses of the `stats` command in Splunk? (Choose three.)

Accepted Answer

Finding the earliest timestamp of events grouped by a field using `earliest(field)`. The `stats` command in Splunk is used to perform statistical aggregations on search results. `count(field)` counts the number of events where the specified field exists, `avg(field)` calculates the mean of a numeric field, and `earliest(field)` returns the earliest (oldest) timestamp value for that field within each group. These are all valid aggregation functions that operate on field values across events.

Answer

Joining two separate searches into a single stats output

Answer

Sorting results in descending order directly within the stats command

Answer

Removing duplicate events based on a field using `dedup` inside the stats command

Question 16

Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)

Accepted Answer

It can combine string values using the `+` operator. The `eval` command in Splunk creates new fields by evaluating expressions based on existing field values and functions, making it a powerful tool for data transformation. It supports conditional logic via the `if` function, allowing dynamic field creation based on conditions. Additionally, `eval` can concatenate string values using the `+` operator, which is a common way to combine text fields.

Answer

It can be used to calculate mathematical expressions like `eval x = y + 1`

Answer

It modifies the original raw data stored in the index

Answer

It can be used to rename fields in the search results

Question 17

Which of the following statements about the `top` and `rare` commands in Splunk are correct? Choose all that apply. (There are four correct answers.)

Accepted Answer

Both `top` and `rare` can include a `by` clause to group results by another field.. The `top` command returns the most common values of a field based on count, and the `rare` command returns the least common values. Both commands support a `by` clause to group results by another field. By default, `top` and `rare` exclude events where the specified field is null or empty from the count, which is a key behavior to understand for accurate analysis.

Answer

Both `top` and `rare` require the `limit` argument to be specified; otherwise, they return no results.

Answer

The `rare` command can only be used on fields that have been extracted using regex.

Question 18

Drag and drop the steps to configure a Splunk forwarder to send data to an indexer into the correct order.

Question 19

Drag and drop the steps to create a Splunk dashboard with a single panel into the correct order.

Question 20

Match each Splunk role to its typical permission scope.