SPLK-5001 SPL Search Proficiency Practice Test 2 — 15 Questions

Question 1

Which TWO of these commands are used for data visualization prep?

Accepted Answer

chart. The question asks for commands used for data visualization prep, and both chart and timechart are correct because they are Splunk transforming commands that aggregate and structure results into a tabular format suitable for rendering visualizations. Option A, chart, produces a table of aggregated values organized by a row split and optional column split, which is the standard data shape consumed by visualization renderers. Option D, timechart, is a specialized transforming command that aggregates metrics over time into a time-series table, directly feeding time-based visualizations such as line and area charts. The unmarked options do not belong: stats is a general transforming command for aggregation but is not itself a visualization-prep command, fields is a search command for including or excluding fields rather than shaping data for charts, and eval is an evaluation command that computes new fields but does not produce the aggregated tabular output required for visualization.

Answer

stats

Answer

fields

Answer

eval

Question 2

Which TWO commands provide information about the fields present in the events?

Accepted Answer

fields. The `fields` command (option D) is correct because it explicitly reports which fields are present in the events, returning the field names (and, with options like `fields -` or `fields +`, showing which are missing or present) so you can inspect the schema of your data. The `table` command (option E) is also correct because it takes a list of field names and renders them as a table, which lets you verify which fields actually exist and are populated in the events. The `lookup` command (option A) is used to enrich events by matching field values against an external lookup table, not to enumerate the fields in the events. The `eval` command (option B) creates or modifies fields by evaluating expressions, so it computes values rather than reporting which fields exist. The `sort` command (option C) orders events by one or more fields, which is a presentation/ordering operation and does not provide information about the fields present.

Answer

lookup

Answer

eval

Answer

sort

Question 3

A SOC analyst is investigating a possible brute-force attack. They run `index=security sourcetype=linux_secure action=failure` and see thousands of results. They need to produce a single report showing the number of failed login attempts per source IP, sorted with the most active source at the top. Which SPL search should they use?

Accepted Answer

index=security sourcetype=linux_secure action=failure | stats count by src_ip | sort - count. The analyst needs a ranked count of failure events grouped by source IP. Aggregating with stats count by src_ip creates one row per IP with its attempt total, and sorting by the count in descending order surfaces the most aggressive source first. This is the standard, efficient SPL pattern for producing a top-talkers report from raw security logs.

Answer

index=security sourcetype=linux_secure action=failure | top limit=0 src_ip

Answer

index=security sourcetype=linux_secure action=failure | table src_ip | dedup src_ip

Answer

index=security sourcetype=linux_secure action=failure | transaction src_ip

Question 4

A security analyst is investigating a potential data exfiltration. They need to identify all outbound connections where the total bytes transferred exceeded 10 MB within a 5-minute window for each source-destination pair. Which SPL command sequence correctly calculates this?

Accepted Answer

bin _time span=5m | stats sum(bytes) as total_bytes by src_ip, dest_ip, _time | where total_bytes > 10000000. To detect large transfers within a specific time window, events must be grouped into time buckets and then aggregated per bucket. The bin command creates 5-minute buckets, and stats sums bytes per source-destination pair per bucket. The where clause then filters for buckets exceeding 10 MB. This ensures detection of any 5-minute window where the threshold is crossed, which is critical for identifying bursty exfiltration.

Answer

timechart span=5m sum(bytes) by src_ip, dest_ip | where sum > 10000000

Answer

stats sum(bytes) as total_bytes by src_ip, dest_ip | where total_bytes > 10000000

Answer

bucket _time span=5m | stats sum(bytes) as total_bytes by src_ip, dest_ip | where total_bytes > 10000000

Question 5

A security analyst is building a search to detect potential data exfiltration by identifying users who have transferred more than 1 GB of data to external IP addresses. The events contain fields 'user', 'bytes_out', and 'dest_ip'. The analyst wants to use the 'eval' command to create a new field 'is_external' that flags external IPs, and then aggregate total bytes per user. Which two SPL commands or functions are essential to achieve this? (Choose two.)

Accepted Answer

stats sum(bytes_out) as total_bytes by user. To detect data exfiltration, the analyst must classify external IPs and sum bytes per user. The eval with cidrmatch creates the classification, and stats sum aggregates total bytes. Together, they enable filtering for external transfers and threshold checking.

Answer

where bytes_out > 1073741824

Answer

transaction user maxspan=1h

Answer

lookup external_ips dest_ip

Question 6

A security analyst needs to correlate failed login attempts with subsequent successful logins from the same source IP within a 10-minute window. The search must return only events where a successful login occurs after at least three failed attempts from the same src_ip. Which SPL command sequence best accomplishes this?

Accepted Answer

index=auth | streamstats window=10 time_window=10m count(eval(action="failed")) as fail_count by src_ip | where action="success" AND fail_count>=3. The streamstats command is ideal for calculating rolling counts over a time window and retaining event order. By counting failed logins per src_ip within a 10-minute window and then filtering for successful logins where the failure count is at least three, the search accurately detects the pattern. Other approaches either lack temporal precision or do not enforce the required sequence.

Answer

index=auth | transaction src_ip maxspan=10m | where eventcount>=4 AND mvcount(action)="failed")>=3 AND mvcount(action)="success")>=1

Answer

index=auth | stats count(eval(action="failed")) as fails count(eval(action="success")) as successes by src_ip | where fails>=3 AND successes>=1

Answer

index=auth | bin _time span=10m | stats count(eval(action="failed")) as fails count(eval(action="success")) as successes by src_ip _time | where fails>=3 AND successes>=1

Question 7

An analyst is building a search that must calculate the time between a user's login and their subsequent logout. The events have a user field and a timestamp, and the events are of type login and logout. Which SPL approach correctly calculates the session duration per user?

Accepted Answer

index=auth (action=login OR action=logout) | sort 0 user, _time | streamstats current=f last(_time) as prev_time by user | eval duration = _time - prev_time | where action=logout. Calculating session duration requires pairing each logout with the login that immediately preceded it for the same user. Sorting by user and time and using streamstats to capture the prior timestamp establishes that pairing, and subtracting gives the duration. Filtering to logout events then yields one duration per completed session, which is the correct and efficient method.

Answer

index=auth action=login OR action=logout | eval login_time=if(action="login", _time, null()) | eval logout_time=if(action="logout", _time, null()) | stats values(login_time) as login_time, values(logout_time) as logout_time by user | eval duration = logout_time - login_time

Answer

index=auth (action=login OR action=logout) | stats range(_time) as duration by user

Answer

index=auth (action=login OR action=logout) | transaction user startswith=action=login endswith=action=logout | eval duration = duration

Question 8

An analyst needs to correlate web proxy logs with firewall logs to identify internal hosts that accessed a known-malicious domain and also had outbound connections blocked. The proxy logs have fields src_ip and dest_domain; the firewall logs have src_ip and action. Which SPL construct best allows joining these two datasets on src_ip while preserving all matching events from both?

Accepted Answer

join type=outer src_ip [search index=firewall action=blocked | fields src_ip action]. The outer join preserves all events from the main search and includes matching events from the subsearch, which is essential when you need to correlate proxy and firewall logs without losing unmatched entries. Inner join would drop non-matching rows, append plus stats loses field association, and transaction is time-bound and not designed for cross-index correlation.

Answer

transaction src_ip maxspan=5m | table src_ip dest_domain action

Answer

join type=inner src_ip [search index=firewall action=blocked | fields src_ip]

Answer

append [search index=firewall action=blocked | fields src_ip] | stats values(dest_domain) values(action) by src_ip

Question 9

A SOC analyst is building a search to surface hosts whose outbound byte volume to external destinations is unusually high. The search must aggregate total bytes sent per src_ip, restrict results to private source addresses, and only return hosts exceeding a defined threshold. Which TWO SPL constructs correctly enforce the private-address filter and the threshold condition within this pipeline? (Choose two.)

Accepted Answer

stats sum(bytes_out) AS total_bytes BY src_ip | where total_bytes > 10000000. Threshold filtering on an aggregated value must happen after stats via where, and private-address restriction is cleanly expressed with CIDR notation in a search clause. Together, the stats-then-where construct and the RFC 1918 CIDR search clause satisfy the aggregation, filtering, and threshold requirements of the scenario.

Answer

eval total_bytes=sum(bytes_out) | where total_bytes > 10000000

Answer

rex field=src_ip "(?<private>^(10|172|192))\." | search private=*

Answer

where src_ip > 10.0.0.0 AND src_ip < 192.168.255.255

Question 10

An analyst needs to correlate two event types: 'authentication' events containing a field 'session_id' and 'process' events also containing 'session_id'. The goal is to display all fields from both event types where the session_id matches, preserving events from both sides even if one side has no match. Which SPL command should be used?

Accepted Answer

join type=outer session_id. The join command with type=outer performs a full outer join, returning all events from both the authentication and process event types, matching on session_id where possible and including unmatched events from either side. This satisfies the requirement to preserve all events from both sides. Other join types or commands like append or transaction do not provide this full outer correlation on a common field.

Answer

append [search index=process]

Answer

join type=left session_id

Answer

transaction session_id

Question 11

A security analyst is investigating a potential data exfiltration incident and needs to identify anomalous outbound traffic volumes. The analyst wants to calculate the standard deviation of bytes transferred per destination IP over the last 24 hours and flag any destination where the total bytes exceed the mean plus two standard deviations. Which two SPL commands are essential to compute the required statistics? (Choose two.)

Accepted Answer

eventstats. To detect anomalous outbound traffic volumes, the analyst must first aggregate total bytes per destination IP and then compute the overall mean and standard deviation. The stats command provides this aggregation and statistical calculation. The eventstats command then adds those statistics back to each event, allowing comparison of each destination's total against the threshold. Together, they enable the calculation of mean plus two standard deviations for flagging outliers.

Answer

top

Answer

transaction

Answer

eval

Question 12

A security analyst is building a search to detect anomalous process executions on endpoints. They need to compare the current hour's process count per host against the average process count for that host over the past 7 days, and alert if the current count exceeds the average by more than 3 standard deviations. Which SPL construct is most appropriate for this statistical comparison?

Accepted Answer

bin _time span=1h | stats count by host, _time | streamstats window=168 avg(count) as avg_count stdev(count) as stdev_count by host | where count > avg_count + 3*stdev_count. To compare the current hour's count against a 7-day rolling average and standard deviation per host, the search must first bucket events into hourly counts per host. Then, streamstats with a window of 168 hours calculates the moving average and standard deviation for each host, providing a dynamic baseline. The where clause then flags hours exceeding three standard deviations above the average, effectively detecting anomalies.

Answer

eventstats avg(count) as avg_count stdev(count) as stdev_count by host | where count > avg_count + 3*stdev_count

Answer

stats count by host | eventstats avg(count) as avg_count stdev(count) as stdev_count | where count > avg_count + 3*stdev_count

Answer

timechart span=1h count by host | predict count as predicted | where count > predicted + 3*stdev

Question 13

A security analyst wants to extract the domain from a URL field named 'url' in web proxy logs. The URL format is 'https://sub.example.com/path'. Which SPL command correctly extracts 'example.com' into a new field called 'domain'?

Accepted Answer

rex field=url "(?\w+\.\w+\.\w+)". The correct regular expression to extract 'example.com' from 'https://sub.example.com/path' is not listed among the options. The pattern that captures three word-character groups separated by dots yields 'sub.example.com', which includes the subdomain. To extract 'example.com', a regex like '(?\w+\.\w+)$' or using the split function on dots and taking the last two elements would be needed. None of the provided options achieve this exactly.

Answer

rex field=url "(?<domain>\w+\.\w+)"

Answer

rex field=url "(?<domain>[^./]+\.\w+)"

Answer

rex field=url "(?<domain>[^/]+\.\w+\.[^/]+)"

Question 14

A security analyst needs to create a search that returns events from the 'index=firewall' where the 'action' field is 'blocked', and then displays only the 'src_ip', 'dest_ip', and 'dest_port' fields, with the 'dest_port' renamed to 'port'. Which SPL search accomplishes this?

Accepted Answer

index=firewall action=blocked | fields src_ip, dest_ip, dest_port | rename dest_port as port. The correct search must filter events, select specific fields, and rename a field. Using fields to select and then rename to change the field name is the standard approach. The order of fields then rename is efficient and clear.

Answer

index=firewall action=blocked | fields src_ip, dest_ip, dest_port as port

Answer

index=firewall action=blocked | rename dest_port as port | fields src_ip, dest_ip, port

Answer

index=firewall action=blocked | table src_ip, dest_ip, dest_port | rename dest_port as port

Question 15

A detection engineer needs to enrich firewall events with an asset-owner lookup table that maps ip to owner. Some events have an ip value that is not present in the lookup. The requirement is to keep ALL firewall events in the results, showing the owner when it exists and leaving it null when it does not. Which SPL search satisfies this?

Accepted Answer

index=firewall | lookup asset_owners ip OUTPUT owner. The lookup command enriches base-search events in place by matching on the ip field and appending the owner field, and it preserves every event whether or not a match is found. That aligns with the requirement to keep all firewall events while adding owner only where the lookup has a corresponding entry.

Answer

index=firewall | join ip [| inputlookup asset_owners | fields ip owner]

Answer

index=firewall | inputlookup asset_owners append=t | stats values(owner) BY ip

Answer

index=firewall | lookup asset_owners ip OUTPUTNEW owner