SPLK-1002 Advanced Searching and Statistics Practice Question
A search needs to find events where the same user logged in from more than 3 different IP addresses within a 5-minute window. Which combination of commands is most efficient?
⚠ Common exam trap
Test-takers frequently choose `streamstats` or `stats` because they are familiar with counting, but they fail to realize that those commands count events per user+IP pair rather than distinct IPs per user within a time window, which is the core requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`| transaction user maxspan=5m | eval distinct_ip=mvcount(src_ip) | where distinct_ip > 3`
The `transaction` command groups events by `user` within a 5-minute window (`maxspan=5m`), then `eval distinct_ip=mvcount(src_ip)` counts the unique IP addresses in that transaction. This directly answers the requirement of finding users who logged in from more than 3 different IPs within a 5-minute window, and it is efficient because `transaction` handles the time-bounded grouping natively without needing to pre-aggregate or use subsearches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`| streamstats count by user src_ip | where count > 3`
Why it's wrong here
`streamstats` counts running total within the stream, not grouping events into transactions.
- ✗
`| timechart span=5m limit=0 values(src_ip) by user | eval count=mvcount(values(src_ip)) | where count > 3`
Why it's wrong here
This creates time buckets, but the same user might appear in multiple buckets; also it uses timechart which is less efficient.
- ✗
`| stats count by user, src_ip | where count > 3`
Why it's wrong here
This counts events per user-IP combo, not distinct IPs per user over time.
- ✓
`| transaction user maxspan=5m | eval distinct_ip=mvcount(src_ip) | where distinct_ip > 3`
Why this is correct
Efficiently groups events by user within a 5-minute window and then counts distinct IP addresses.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user needs to find events where a user had a failed login followed by a successful login within 10 minutes, and then list the total number of such occurrences per user. Which THREE steps are necessary? (Select three.)
medium- A.Use the eval command to set a field for failure status
- ✓ B.Use the stats command to count by user
- C.Use the where command to filter transactions with both failure and success
- ✓ D.Use the transaction command with maxspan=10m
- ✓ E.Use the transaction command with startswith and endswith
Why B: To find events where a failed login is followed by a successful login within 10 minutes, and count such occurrences per user, the necessary steps are: use the transaction command with maxspan=10m to group events in a 10-minute window (D), use startswith and endswith to define the transaction boundaries (e.g., startswith='failed login' and endswith='successful login') (E), and then use stats count by user to tally the number of completed transactions per user (B). Options A and C are incorrect because inline eval is not needed to mark failure status, and using where after transaction would filter transactions but the counting is done by stats; also, using where alone without transaction would not capture the paired events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.