20+ practice questions focused on Basic Searching and Transforming Commands — one of the most tested topics on the Splunk Core Certified User SPLK-1002 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Basic Searching and Transforming Commands PracticeHow many events will be output by this search?
Explanation: The total number of events before the dedup command (not shown) is 15, but dedup on a field with only 3 unique values reduces the output to 3 events.
Which three of the following statements about the `eval` command in Splunk are correct? (Choose three.)
Explanation: The `eval` command in Splunk is used to create new fields by evaluating expressions. It supports conditional logic with the `if` function (true for C). It can evaluate mathematical expressions like `eval x = y + 1` (true for F). However, it does not rename fields (B), modify raw indexed data (D), or combine strings using the `+` operator; string concatenation in Splunk eval uses the `.` operator or `concat` function (E is false).
Refer to the exhibit. A security analyst runs this search and gets two rows: threat_level 'high' and 'low'. However, many events have threat_score between 60 and 90 that are not captured. How should the search be modified to include a 'medium' category?
Explanation: The existing `eval` command uses an `if` function, which only supports a single condition and a single else clause. To create three categories (high, medium, low), you need a `case` statement that evaluates multiple conditions in order, allowing you to assign 'medium' for threat_score between 60 and 90. The `case` function returns the value for the first true condition, making it ideal for multi-category classification.
A user needs to see the trend of login failures over the past 7 days, broken down by hour. Which command should be used?
Explanation: D is correct because `chart count over _time` automatically creates a time-based chart with hourly buckets for a 7-day window, showing the trend of login failures. Options A and C produce counts per unique timestamp, not binned. B is not a transforming command.
A security analyst uses Splunk to ingest firewall logs from multiple locations. The index is 'firewall' and the sourcetype is 'fw_log'. Each event contains fields: src_ip, dest_ip, action, bytes, and time. The analyst needs to find how many unique source IPs have been logged in the last hour to report potential scanning activity. The search should be efficient and accurate, returning only the total count of distinct source IPs. Which search accomplishes this?
Explanation: It uses the `stats dc(src_ip)` command, which directly calculates the distinct count of source IPs in a single, efficient pass over the data. The `earliest=-1h` time filter restricts the search to the last hour, and the `as UniqueIPs` alias provides the exact output requested: a single number representing the total count of unique source IPs.
+15 more Basic Searching and Transforming Commands questions available
Practice all Basic Searching and Transforming Commands questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Basic Searching and Transforming Commands. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Basic Searching and Transforming Commands questions on the SPLK-1001 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Basic Searching and Transforming Commands is tested as part of the Splunk Core Certified User SPLK-1002 blueprint. Practicing with targeted Basic Searching and Transforming Commands questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SPLK-1001 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Basic Searching and Transforming Commands is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Basic Searching and Transforming Commands practice session with instant scoring and detailed explanations.
Start Basic Searching and Transforming Commands Practice →