31 questions · Transforming Commands And Formatting · All types, answers revealed
Which command is used to display specific fields in the output?
The fields command specifies which fields to keep or drop.
Why this answer
The 'fields' command is used to include or exclude fields from the results.
You want to filter out events where the 'action' field is empty. Which command is best?
This explicitly checks for null and empty string values.
Why this answer
The 'where' command allows for complex logical filtering.
Which TWO are true about the 'eval' command?
Eval handles if/case logic.
Why this answer
It handles math and case sensitivity.
Which command would you use to rename a field to a more readable name in the middle of a search pipeline?
This is the correct syntax for renaming fields.
Why this answer
The 'rename' command is the standard way to alias field names.
Which TWO of the following are true about 'eventstats'?
This is the primary function of eventstats.
Why this answer
Eventstats adds results to existing events rather than replacing them.
You need to combine two fields into one string. Which eval function is used?
The period character performs string concatenation in eval.
Why this answer
The '.' operator or the 'concat' function (in some contexts) or simply concatenating works.
Which TWO are common causes for a 'transaction' command taking too long?
High cardinality slows down transaction grouping.
Why this answer
Large datasets and long time spans cause performance issues.
You want to round a number in a field to two decimal places. Which function is used?
Round() is the correct function.
Why this answer
The 'round' function takes the field and the number of decimal places.
How do you extract a portion of a string using 'eval'?
Substr is the correct function.
Why this answer
The 'substr' function extracts a substring based on start and length indices.
When using 'stats', how does the 'values()' function differ from 'list()'?
This is the primary functional difference.
Why this answer
Values() returns unique entries, while list() returns every entry found.
Which command sorts results by a field in descending order?
The minus sign denotes descending order.
Why this answer
The 'sort -field' syntax sorts in reverse (descending) order.
Which 'eval' function is used to handle conditional logic?
Case evaluates multiple conditions and returns the value of the first one that is true.
Why this answer
The 'case' function is specifically designed for multiple conditional tests.
Which THREE of the following are valid ways to filter data in Splunk?
The fields command can filter out unwanted fields.
Why this answer
Search, where, and fields (with -) are all used to filter.
You are correlating two searches. What is the primary advantage of using 'join' over 'lookup'?
Joins allow joining a results set from a subsearch to the primary search.
Why this answer
Joins are performed at search time and allow for dynamic subsearch results, whereas lookups are usually static files.
What is the result of 'transaction' command compared to 'stats'?
Transaction is designed to link events into a single transaction object.
Why this answer
Transaction groups events into a single entity based on shared fields and time constraints.
Which command is used to remove a field from the search results?
The minus sign explicitly excludes the field.
Why this answer
The 'fields -' command removes specified fields.
Which THREE features are available when using the 'lookup' command?
Standard lookup behavior is a left join.
Why this answer
Lookups can be used as outputs, inputs, and with wildcards.
How do you handle case-insensitive filtering in a 'where' clause?
Normalizing both sides is the standard way to ensure case-insensitivity.
Why this answer
The 'lower()' function is used to normalize the string for comparison.
Which THREE of the following functions are used with 'stats' to aggregate data?
Max is an aggregation.
Why this answer
Sum, count, and max are all valid stats functions.
What is the limitation of using 'join' in a search?
The default maxout limit for subsearches in a join is 100, which can cause data loss.
Why this answer
Joins are memory-intensive and have strict limits on the number of results they can process.
How do you add a total row to a stats table?
Addtotals is the correct command to sum values.
Why this answer
The 'addcoltotals' command adds a row containing the sum of all numerical columns.
Which THREE of the following are valid aggregation functions used with 'stats'?
Dc (distinct count) is a valid function.
Why this answer
Count, avg, and dc are standard aggregation functions.
How do you calculate the percentage of total events for each status code?
This uses eventstats to calculate the total across all rows for the percentage calculation.
Why this answer
The 'addcoltotals' or 'eventcount' can be used, but 'stats' with 'perc' or manual calculation is standard.
What is the purpose of 'streamstats' compared to 'stats'?
Streamstats maintains a running calculation.
Why this answer
Streamstats calculates statistics as events flow through the pipeline, rather than waiting for all results.
You want to see a list of unique 'clientip' addresses. Which command is most efficient?
Dedup returns the first instance of each unique value.
Why this answer
The 'dedup' command is designed to show unique occurrences of a field.
What is the difference between 'chart' and 'timechart'?
Timechart manages time binning automatically.
Why this answer
Timechart forces the x-axis to be time-based, while chart allows any field on the x-axis.
Which THREE of the following are valid formatting commands?
Rename is for readability.
Why this answer
Fieldformat, rename, and sort are all formatting.
Which TWO of the following commands are considered 'transforming' commands?
Timechart is a transforming command.
Why this answer
Transforming commands change data into a table format (like stats/chart).
Which TWO actions can be performed by the 'eval' command?
Eval performs string concatenation.
Why this answer
Eval allows for math operations and string manipulation.
When using 'chart', what is the behavior if you do not specify a 'by' clause?
Without a 'by' clause, it aggregates the entire result set into one value.
Why this answer
If no 'by' clause is provided, 'chart' returns a single series based on the aggregation function.
You need to count the total number of unique users per department using the 'stats' command. Which command syntax is correct?
The dc() function correctly identifies distinct counts.
Why this answer
The 'dc' function (distinct count) is used to count unique values in a field.
Ready to test yourself?
Try a timed practice session using only Transforming Commands And Formatting questions.