SPLK-5001 SPL Search Proficiency — 20 Questions

Question 1

You need to identify the top 5 source IPs that have triggered the most 'failed_login' events in the last 24 hours. Which command sequence should you use?

Accepted Answer

index=security sourcetype=auth failed_login | top limit=5 src_ip. The stats command is the standard way to aggregate event counts by a specific field.

Answer

index=security sourcetype=auth failed_login | stats count as count by src_ip | sort -count | head 5

Answer

index=security sourcetype=auth failed_login | table src_ip | count

Answer

index=security sourcetype=auth failed_login | cluster src_ip | head 5

Question 2

Which command would you use to find statistical outliers in your dataset?

Accepted Answer

outlier action=remove. The 'outlier' command is used to remove or flag outliers.

Answer

filter_outliers

Answer

find_outliers

Answer

stats anomaly count

Question 3

Which command is used to visualize data in a time-series chart?

Accepted Answer

timechart count by sourcetype. The 'timechart' command is specifically for time-series visualization.

Answer

graph count _time

Answer

stats count over time

Answer

chart count by _time

Question 4

Which command would you use to filter out events where the 'status' field is 200?

Accepted Answer

search status!=200. The 'where' command or 'search' command can be used to filter events.

Answer

eval status!=200

Answer

where status=200

Answer

drop status=200

Question 5

Which command is used to rename a field in the results table for better readability?

Accepted Answer

rename src_ip as "Source Address". The rename command allows changing the display name of a field.

Answer

table src_ip as "Source Address"

Answer

fields src_ip:"Source Address"

Answer

eval "Source Address" = src_ip

Question 6

You need to calculate the average time delta between 'login' and 'logout' events for each user. Which command approach is most effective?

Accepted Answer

index=auth | transaction user_id | stats avg(duration) by user_id. Transaction is effective for grouping events by a common ID and calculating duration.

Answer

index=auth | delta _time as time_diff by user_id

Answer

index=auth | stats min(_time) as start, max(_time) as end by user_id | eval delta=end-start

Answer

index=auth | eval time_diff = logout_time - login_time

Question 7

You need to append the contents of a lookup file 'threat_intel.csv' to your search results based on the field 'src_ip'. Which command is correct?

Accepted Answer

index=firewall | lookup threat_intel.csv src_ip OUTPUTNEW severity, threat_type. The lookup command is designed to enrich events with data from a lookup file.

Answer

index=firewall | enrich src_ip threat_intel.csv

Answer

index=firewall | join src_ip [inputlookup threat_intel.csv]

Answer

index=firewall | inputlookup threat_intel.csv src_ip

Answer

index=firewall | append threat_intel.csv

Question 8

You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?

Accepted Answer

index=network | lookup authorized_servers.csv ip_address AS dest_ip OUTPUT ip_address as is_authorized | where is_authorized="". The 'inputlookup' combined with 'NOT [search]' or the 'lookup' command with a filter is used for exclusion.

Answer

index=network | inputlookup authorized_servers.csv | where dest_ip!=ip_address

Answer

index=network | lookup authorized_servers.csv dest_ip | where isnull(dest_ip)

Answer

index=network | filter dest_ip NOT IN authorized_servers.csv

Question 9

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

Accepted Answer

Subsearches are limited by the 'maxout' configuration and execution time.. Subsearches have a limit on the number of results returned (default 10,000) and a time limit.

Answer

Subsearches only return the first 10 results.

Answer

Subsearches cannot use the 'stats' command.

Answer

Subsearches cannot reference fields from the outer search.

Answer

Subsearches always run after the outer search completes.

Question 10

Which command allows you to limit the number of fields displayed in your final results table?

Accepted Answer

fields + src_ip, dest_ip. The 'fields' command is used to include or exclude fields from the event display.

Answer

table src_ip, dest_ip

Answer

select src_ip, dest_ip

Answer

show src_ip, dest_ip

Question 11

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

Accepted Answer

spath input=raw_data. The 'spath' command is specifically designed to parse JSON or XML data.

Answer

eval json_parse(raw_data)

Answer

json raw_data

Answer

extract json raw_data

Question 12

You want to use the 'eval' command to create a new field 'is_critical' that is 'yes' if 'severity' is 'high' or 'critical', and 'no' otherwise. Which syntax is correct?

Accepted Answer

eval is_critical = if(severity IN("high", "critical"), "yes", "no"). The 'if' function combined with 'in' or 'OR' logic is required.

Answer

eval is_critical = if(severity=="high" || "critical", "yes", "no")

Answer

eval is_critical = case(severity="high" OR "critical", "yes", 1=1, "no")

Answer

eval is_critical = switch(severity, "high", "yes", "critical", "yes")

Question 13

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

Accepted Answer

outputlookup ioc_list.csv. The 'outputlookup' command writes search results to a lookup file.

Answer

saveas lookup ioc_list.csv

Answer

write ioc_list.csv

Answer

inputlookup ioc_list.csv --append

Question 14

What is the purpose of the 'head' command?

Accepted Answer

Return the first N results.. The 'head' command returns the first N results from a search.

Answer

Return the last N results.

Answer

Sort the results.

Answer

Count the results.

Question 15

When using 'stats', how can you include the values of a field as columns in your output?

Accepted Answer

stats count by host, sourcetype | xyseries host, sourcetype, count. The 'xyseries' or 'chart' command is used to create columns from field values.

Answer

stats count by host, sourcetype

Answer

stats count by host | transpose

Answer

stats pivot host sourcetype

Question 16

You are performing a search and want to ensure the subsearch runs against a specific time range relative to the main search. Which command/option achieves this?

Accepted Answer

search index=logs [search index=logs earliest=-24h]. The 'earliest' and 'latest' arguments within a subsearch bracket control the time window.

Answer

set_time -24h

Answer

subsearch_time=-24h

Question 17

What is the result of using 'bin _time span=1d'?

Accepted Answer

Groups events into 24-hour buckets.. Binning the time field rounds down to the nearest day.

Answer

Counts events per day.

Answer

Deletes events older than 1 day.

Answer

Changes the display format of the timestamp.

Question 18

Which command is used to append results from one search to another?

Accepted Answer

append [search index=other]. The 'append' command adds results to the current result set.

Answer

add [search index=other]

Answer

join [search index=other]

Answer

combine [search index=other]

Question 19

You want to calculate the standard deviation of 'response_time' per 'server'. Which command is correct?

Accepted Answer

stats stdev(response_time) as std_dev by server. The 'stdev' function is used within the stats command.

Answer

stats variance(response_time) as std_dev by server

Answer

stats sigma(response_time) by server

Answer

stats dev(response_time) by server

Question 20

How can you ensure that a search field is only treated as a number for calculation purposes?

Accepted Answer

eval count = tonumber(count). The 'tonumber' function in 'eval' converts a string to a number.

Answer

eval count = number(count)

Answer

cast(count as int)

Answer

eval count = int(count)