SPLK-5001 SPL Search Proficiency — 30 Questions

Question 1

Which command would you use to filter out events where the 'status' field is 200?

Accepted Answer

search status!=200. The search command is the implicit base command in SPL and supports inline field comparisons like 'status!=200' to filter events. Writing 'search status!=200' explicitly filters out events where status equals 200, returning only events where status is not 200. This is the correct and idiomatic way to filter at the search level.

Answer

eval status!=200

Answer

where status=200

Answer

drop status=200

Question 2

You need to calculate the average time delta between 'login' and 'logout' events for each user. Which command approach is most effective?

Accepted Answer

index=auth | transaction user_id | stats avg(duration) by user_id. The transaction command groups related events (login and logout) by a common field such as user_id, and automatically computes a duration field representing the time between the first and last event in each transaction. Piping to stats avg(duration) by user_id then yields the average session duration per user, which is exactly the requested average time delta.

Answer

index=auth | delta _time as time_diff by user_id

Answer

index=auth | stats min(_time) as start, max(_time) as end by user_id | eval delta=end-start

Answer

index=auth | eval time_diff = logout_time - login_time

Question 3

You need to identify the top 5 source IPs that have triggered the most 'failed_login' events in the last 24 hours. Which command sequence should you use?

Accepted Answer

index=security sourcetype=auth failed_login | top limit=5 src_ip. The stats command is the standard way to aggregate event counts by a specific field.

Answer

index=security sourcetype=auth failed_login | stats count as count by src_ip | sort -count | head 5

Answer

index=security sourcetype=auth failed_login | table src_ip | count

Answer

index=security sourcetype=auth failed_login | cluster src_ip | head 5

Question 4

You need to append the contents of a lookup file 'threat_intel.csv' to your search results based on the field 'src_ip'. Which command is correct?

Accepted Answer

index=firewall | lookup threat_intel.csv src_ip OUTPUTNEW severity, threat_type. The `lookup` command is Splunk's native mechanism for enriching events with fields from a lookup table (CSV or KV Store). The syntax `lookup OUTPUTNEW , ` matches the event field `src_ip` against the lookup's key field and appends the specified output fields only if they don't already exist. `OUTPUTNEW` is preferred over `OUTPUT` because it avoids overwriting existing fields in the event.

Answer

index=firewall | enrich src_ip threat_intel.csv

Answer

index=firewall | join src_ip [inputlookup threat_intel.csv]

Answer

index=firewall | inputlookup threat_intel.csv src_ip

Answer

index=firewall | append threat_intel.csv

Question 5

You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?

Accepted Answer

index=network | lookup authorized_servers.csv ip_address AS dest_ip OUTPUT ip_address as is_authorized | where is_authorized="". The correct command uses a lookup to match the 'dest_ip' field in the network events against the 'ip_address' field in the authorized_servers.csv lookup, outputting a field 'is_authorized'. The 'where is_authorized=""' clause then filters for events where no match was found, effectively finding connections to IPs not in the authorized list.

Answer

index=network | inputlookup authorized_servers.csv | where dest_ip!=ip_address

Answer

index=network | lookup authorized_servers.csv dest_ip | where isnull(dest_ip)

Answer

index=network | filter dest_ip NOT IN authorized_servers.csv

Question 6

Which command allows you to limit the number of fields displayed in your final results table?

Accepted Answer

fields + src_ip, dest_ip. The 'fields + src_ip, dest_ip' command explicitly includes only the specified fields in the results, effectively limiting the displayed fields to just those listed. The '+' modifier tells Splunk to keep only the named fields (as opposed to '-' which removes them), making it the correct way to limit fields shown in the final results table. This is a core SPL field-selection command.

Answer

table src_ip, dest_ip

Answer

select src_ip, dest_ip

Answer

show src_ip, dest_ip

Question 7

You want to use the 'eval' command to create a new field 'is_critical' that is 'yes' if 'severity' is 'high' or 'critical', and 'no' otherwise. Which syntax is correct?

Accepted Answer

eval is_critical = if(severity IN("high", "critical"), "yes", "no"). The IN() function in eval is the correct way to test a field against a list of values. 'if(severity IN("high", "critical"), "yes", "no")' evaluates to yes when severity matches either value and no otherwise, which is exactly the required logic. IN() is a first-class eval function in Splunk and is the idiomatic pattern for multi-value comparisons.

Answer

eval is_critical = if(severity=="high" || "critical", "yes", "no")

Answer

eval is_critical = case(severity="high" OR "critical", "yes", 1=1, "no")

Answer

eval is_critical = switch(severity, "high", "yes", "critical", "yes")

Question 8

You are performing a search and want to ensure the subsearch runs against a specific time range relative to the main search. Which command/option achieves this?

Accepted Answer

search index=logs [search index=logs earliest=-24h]. Subsearch time ranges are set inside the subsearch brackets using earliest/latest, which scopes the subsearch independently of the main search. Option A shows a subsearch with earliest=-24h inside the brackets, and Option B shows a subsearch that returns hosts with its own time constraint. Both correctly scope the subsearch's time window relative to the main search.

Answer

set_time -24h

Answer

subsearch_time=-24h

Question 9

Which command would you use to find statistical outliers in your dataset?

Accepted Answer

outlier action=remove. The 'outlier' command is used to remove or flag outliers.

Answer

filter_outliers

Answer

find_outliers

Answer

stats anomaly count

Question 10

How can you ensure that a search field is only treated as a number for calculation purposes?

Accepted Answer

eval count = tonumber(count). The tonumber() eval function explicitly converts a field's value to a numeric type, ensuring it is treated as a number for calculations. This is the correct way to force numeric interpretation in Splunk's eval expressions, and it handles both integer and floating-point values. It is the standard function for numeric casting in SPL.

Answer

eval count = number(count)

Answer

cast(count as int)

Answer

eval count = int(count)

Question 11

Which character acts as a wildcard in a search string?

Accepted Answer

*. In Splunk Search Processing Language (SPL), the asterisk (*) is the multi-character wildcard that matches zero or more characters within a search term. It can be used in the search command (e.g., status=4*) and in eval functions like like() and match(). This is the standard wildcard character documented for Splunk search strings.

Answer

$

Answer

?

Answer

%

Question 12

You want to find the total count of events per hour over the last week. Which command sequence is most efficient?

Accepted Answer

bin _time span=1h | stats count by _time. Using 'bin' followed by 'stats' is the most efficient pattern.

Answer

chart count by _time | bucket 1h

Answer

stats count by _time_hour

Question 13

Which TWO commands are commonly used to remove or limit the results returned by a search?

Accepted Answer

head. In this scenario, the goal is to remove or limit the results returned by a search, and both head and dedup accomplish that. Option A, head, is correct because it restricts the result set to the first N events (for example, head 10 returns only the first 10 results), directly limiting the number of returned results. Option B, dedup, is correct because it removes duplicate results by returning only the first occurrence of each distinct combination of specified fields (for example, dedup host), thereby reducing the result set. Option C, eval, is not correct because it creates or modifies fields using expressions rather than removing or limiting results. Option D, stats, is not correct because it performs aggregations such as count, sum, or average and does not by itself limit or remove returned results. Option E, rename, is not correct because it only renames existing fields and has no effect on the number of results returned.

Answer

eval

Answer

stats

Answer

rename

Question 14

Which command is used to calculate the 'count' of events and concurrently keep the original 'raw' text?

Accepted Answer

eventstats count by host. eventstats computes aggregate statistics (like count by host) and appends the result as a new field to every original event, preserving the raw text and all existing fields. This is exactly what the question requires: a count that coexists with the original raw data. stats, by contrast, replaces the event stream with aggregated results and discards raw.

Answer

collect count by host

Answer

stats count by host

Answer

streamstats count by host

Question 15

Which TWO commands require a grouping field to function correctly?

Accepted Answer

transaction. The transaction command (A) requires a grouping field because it correlates events into transactions by a common value such as a session ID or user, using the syntax transaction <field>, and without a grouping field it cannot meaningfully link related events. The stats command (C) also requires a grouping field (the by clause) to aggregate results into groups, for example stats count by host, since without a by field it produces a single overall aggregation rather than grouped statistics. The eval command (B) is incorrect because it creates or modifies fields using expressions and does not need a grouping field. The search command (D) is incorrect because it filters events with keywords or boolean expressions and does not require grouping. The rename command (E) is incorrect because it simply renames fields and operates without any grouping field.

Answer

eval

Answer

search

Answer

rename

Question 16

Which TWO of these commands are used for data visualization prep?

Accepted Answer

chart. The question asks for commands used for data visualization prep, and both chart and timechart are correct because they are Splunk transforming commands that aggregate and structure results into a tabular format suitable for rendering visualizations. Option A, chart, produces a table of aggregated values organized by a row split and optional column split, which is the standard data shape consumed by visualization renderers. Option D, timechart, is a specialized transforming command that aggregates metrics over time into a time-series table, directly feeding time-based visualizations such as line and area charts. The unmarked options do not belong: stats is a general transforming command for aggregation but is not itself a visualization-prep command, fields is a search command for including or excluding fields rather than shaping data for charts, and eval is an evaluation command that computes new fields but does not produce the aggregated tabular output required for visualization.

Answer

stats

Answer

fields

Answer

eval

Question 17

Which TWO commands provide information about the fields present in the events?

Accepted Answer

fields. The `fields` command (option D) is correct because it explicitly reports which fields are present in the events, returning the field names (and, with options like `fields -` or `fields +`, showing which are missing or present) so you can inspect the schema of your data. The `table` command (option E) is also correct because it takes a list of field names and renders them as a table, which lets you verify which fields actually exist and are populated in the events. The `lookup` command (option A) is used to enrich events by matching field values against an external lookup table, not to enumerate the fields in the events. The `eval` command (option B) creates or modifies fields by evaluating expressions, so it computes values rather than reporting which fields exist. The `sort` command (option C) orders events by one or more fields, which is a presentation/ordering operation and does not provide information about the fields present.

Answer

lookup

Answer

eval

Answer

sort

Question 18

A SOC analyst is investigating a possible brute-force attack. They run `index=security sourcetype=linux_secure action=failure` and see thousands of results. They need to produce a single report showing the number of failed login attempts per source IP, sorted with the most active source at the top. Which SPL search should they use?

Accepted Answer

index=security sourcetype=linux_secure action=failure | stats count by src_ip | sort - count. The analyst needs a ranked count of failure events grouped by source IP. Aggregating with stats count by src_ip creates one row per IP with its attempt total, and sorting by the count in descending order surfaces the most aggressive source first. This is the standard, efficient SPL pattern for producing a top-talkers report from raw security logs.

Answer

index=security sourcetype=linux_secure action=failure | top limit=0 src_ip

Answer

index=security sourcetype=linux_secure action=failure | table src_ip | dedup src_ip

Answer

index=security sourcetype=linux_secure action=failure | transaction src_ip

Question 19

A security analyst is investigating a potential data exfiltration. They need to identify all outbound connections where the total bytes transferred exceeded 10 MB within a 5-minute window for each source-destination pair. Which SPL command sequence correctly calculates this?

Accepted Answer

bin _time span=5m | stats sum(bytes) as total_bytes by src_ip, dest_ip, _time | where total_bytes > 10000000. To detect large transfers within a specific time window, events must be grouped into time buckets and then aggregated per bucket. The bin command creates 5-minute buckets, and stats sums bytes per source-destination pair per bucket. The where clause then filters for buckets exceeding 10 MB. This ensures detection of any 5-minute window where the threshold is crossed, which is critical for identifying bursty exfiltration.

Answer

timechart span=5m sum(bytes) by src_ip, dest_ip | where sum > 10000000

Answer

stats sum(bytes) as total_bytes by src_ip, dest_ip | where total_bytes > 10000000

Answer

bucket _time span=5m | stats sum(bytes) as total_bytes by src_ip, dest_ip | where total_bytes > 10000000

Question 20

A security analyst is building a search to detect potential data exfiltration by identifying users who have transferred more than 1 GB of data to external IP addresses. The events contain fields 'user', 'bytes_out', and 'dest_ip'. The analyst wants to use the 'eval' command to create a new field 'is_external' that flags external IPs, and then aggregate total bytes per user. Which two SPL commands or functions are essential to achieve this? (Choose two.)

Accepted Answer

stats sum(bytes_out) as total_bytes by user. To detect data exfiltration, the analyst must classify external IPs and sum bytes per user. The eval with cidrmatch creates the classification, and stats sum aggregates total bytes. Together, they enable filtering for external transfers and threshold checking.

Answer

where bytes_out > 1073741824

Answer

transaction user maxspan=1h

Answer

lookup external_ips dest_ip