SPLK-5001 SPL Search Proficiency Practice Test 1 — 15 Questions

Question 1

Which command would you use to filter out events where the 'status' field is 200?

Accepted Answer

search status!=200. The search command is the implicit base command in SPL and supports inline field comparisons like 'status!=200' to filter events. Writing 'search status!=200' explicitly filters out events where status equals 200, returning only events where status is not 200. This is the correct and idiomatic way to filter at the search level.

Answer

eval status!=200

Answer

where status=200

Answer

drop status=200

Question 2

You need to calculate the average time delta between 'login' and 'logout' events for each user. Which command approach is most effective?

Accepted Answer

index=auth | transaction user_id | stats avg(duration) by user_id. The transaction command groups related events (login and logout) by a common field such as user_id, and automatically computes a duration field representing the time between the first and last event in each transaction. Piping to stats avg(duration) by user_id then yields the average session duration per user, which is exactly the requested average time delta.

Answer

index=auth | delta _time as time_diff by user_id

Answer

index=auth | stats min(_time) as start, max(_time) as end by user_id | eval delta=end-start

Answer

index=auth | eval time_diff = logout_time - login_time

Question 3

You need to identify the top 5 source IPs that have triggered the most 'failed_login' events in the last 24 hours. Which command sequence should you use?

Accepted Answer

index=security sourcetype=auth failed_login | top limit=5 src_ip. The stats command is the standard way to aggregate event counts by a specific field.

Answer

index=security sourcetype=auth failed_login | stats count as count by src_ip | sort -count | head 5

Answer

index=security sourcetype=auth failed_login | table src_ip | count

Answer

index=security sourcetype=auth failed_login | cluster src_ip | head 5

Question 4

You need to append the contents of a lookup file 'threat_intel.csv' to your search results based on the field 'src_ip'. Which command is correct?

Accepted Answer

index=firewall | lookup threat_intel.csv src_ip OUTPUTNEW severity, threat_type. The `lookup` command is Splunk's native mechanism for enriching events with fields from a lookup table (CSV or KV Store). The syntax `lookup OUTPUTNEW , ` matches the event field `src_ip` against the lookup's key field and appends the specified output fields only if they don't already exist. `OUTPUTNEW` is preferred over `OUTPUT` because it avoids overwriting existing fields in the event.

Answer

index=firewall | enrich src_ip threat_intel.csv

Answer

index=firewall | join src_ip [inputlookup threat_intel.csv]

Answer

index=firewall | inputlookup threat_intel.csv src_ip

Answer

index=firewall | append threat_intel.csv

Question 5

You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?

Accepted Answer

index=network | lookup authorized_servers.csv ip_address AS dest_ip OUTPUT ip_address as is_authorized | where is_authorized="". The correct command uses a lookup to match the 'dest_ip' field in the network events against the 'ip_address' field in the authorized_servers.csv lookup, outputting a field 'is_authorized'. The 'where is_authorized=""' clause then filters for events where no match was found, effectively finding connections to IPs not in the authorized list.

Answer

index=network | inputlookup authorized_servers.csv | where dest_ip!=ip_address

Answer

index=network | lookup authorized_servers.csv dest_ip | where isnull(dest_ip)

Answer

index=network | filter dest_ip NOT IN authorized_servers.csv

Question 6

Which command allows you to limit the number of fields displayed in your final results table?

Accepted Answer

fields + src_ip, dest_ip. The 'fields + src_ip, dest_ip' command explicitly includes only the specified fields in the results, effectively limiting the displayed fields to just those listed. The '+' modifier tells Splunk to keep only the named fields (as opposed to '-' which removes them), making it the correct way to limit fields shown in the final results table. This is a core SPL field-selection command.

Answer

table src_ip, dest_ip

Answer

select src_ip, dest_ip

Answer

show src_ip, dest_ip

Question 7

You want to use the 'eval' command to create a new field 'is_critical' that is 'yes' if 'severity' is 'high' or 'critical', and 'no' otherwise. Which syntax is correct?

Accepted Answer

eval is_critical = if(severity IN("high", "critical"), "yes", "no"). The IN() function in eval is the correct way to test a field against a list of values. 'if(severity IN("high", "critical"), "yes", "no")' evaluates to yes when severity matches either value and no otherwise, which is exactly the required logic. IN() is a first-class eval function in Splunk and is the idiomatic pattern for multi-value comparisons.

Answer

eval is_critical = if(severity=="high" || "critical", "yes", "no")

Answer

eval is_critical = case(severity="high" OR "critical", "yes", 1=1, "no")

Answer

eval is_critical = switch(severity, "high", "yes", "critical", "yes")

Question 8

You are performing a search and want to ensure the subsearch runs against a specific time range relative to the main search. Which command/option achieves this?

Accepted Answer

search index=logs [search index=logs earliest=-24h]. Subsearch time ranges are set inside the subsearch brackets using earliest/latest, which scopes the subsearch independently of the main search. Option A shows a subsearch with earliest=-24h inside the brackets, and Option B shows a subsearch that returns hosts with its own time constraint. Both correctly scope the subsearch's time window relative to the main search.

Answer

set_time -24h

Answer

subsearch_time=-24h

Question 9

Which command would you use to find statistical outliers in your dataset?

Accepted Answer

outlier action=remove. The 'outlier' command is used to remove or flag outliers.

Answer

filter_outliers

Answer

find_outliers

Answer

stats anomaly count

Question 10

How can you ensure that a search field is only treated as a number for calculation purposes?

Accepted Answer

eval count = tonumber(count). The tonumber() eval function explicitly converts a field's value to a numeric type, ensuring it is treated as a number for calculations. This is the correct way to force numeric interpretation in Splunk's eval expressions, and it handles both integer and floating-point values. It is the standard function for numeric casting in SPL.

Answer

eval count = number(count)

Answer

cast(count as int)

Answer

eval count = int(count)

Question 11

Which character acts as a wildcard in a search string?

Accepted Answer

*. In Splunk Search Processing Language (SPL), the asterisk (*) is the multi-character wildcard that matches zero or more characters within a search term. It can be used in the search command (e.g., status=4*) and in eval functions like like() and match(). This is the standard wildcard character documented for Splunk search strings.

Answer

$

Answer

?

Answer

%

Question 12

You want to find the total count of events per hour over the last week. Which command sequence is most efficient?

Accepted Answer

bin _time span=1h | stats count by _time. Using 'bin' followed by 'stats' is the most efficient pattern.

Answer

chart count by _time | bucket 1h

Answer

stats count by _time_hour

Question 13

Which TWO commands are commonly used to remove or limit the results returned by a search?

Accepted Answer

head. In this scenario, the goal is to remove or limit the results returned by a search, and both head and dedup accomplish that. Option A, head, is correct because it restricts the result set to the first N events (for example, head 10 returns only the first 10 results), directly limiting the number of returned results. Option B, dedup, is correct because it removes duplicate results by returning only the first occurrence of each distinct combination of specified fields (for example, dedup host), thereby reducing the result set. Option C, eval, is not correct because it creates or modifies fields using expressions rather than removing or limiting results. Option D, stats, is not correct because it performs aggregations such as count, sum, or average and does not by itself limit or remove returned results. Option E, rename, is not correct because it only renames existing fields and has no effect on the number of results returned.

Answer

eval

Answer

stats

Answer

rename

Question 14

Which command is used to calculate the 'count' of events and concurrently keep the original 'raw' text?

Accepted Answer

eventstats count by host. eventstats computes aggregate statistics (like count by host) and appends the result as a new field to every original event, preserving the raw text and all existing fields. This is exactly what the question requires: a count that coexists with the original raw data. stats, by contrast, replaces the event stream with aggregated results and discards raw.

Answer

collect count by host

Answer

stats count by host

Answer

streamstats count by host

Question 15

Which TWO commands require a grouping field to function correctly?

Accepted Answer

transaction. The transaction command (A) requires a grouping field because it correlates events into transactions by a common value such as a session ID or user, using the syntax transaction <field>, and without a grouping field it cannot meaningfully link related events. The stats command (C) also requires a grouping field (the by clause) to aggregate results into groups, for example stats count by host, since without a by field it produces a single overall aggregation rather than grouped statistics. The eval command (B) is incorrect because it creates or modifies fields using expressions and does not need a grouping field. The search command (D) is incorrect because it filters events with keywords or boolean expressions and does not require grouping. The rename command (E) is incorrect because it simply renames fields and operates without any grouping field.

Answer

eval

Answer

search

Answer

rename