SPLK-1002 Advanced Searching and Statistics Practice Question
A security analyst needs to find all events where the field 'user' has a value that is either 'admin' or 'root', but the search is returning too many results from a noisy source. Which search best filters the events to only include those where the 'user' field exactly matches 'admin' or 'root'?
⚠ Common exam trap
Splunk often tests the distinction between exact match operators (`=`, `IN`) and wildcard patterns (`*`), trapping candidates who assume that `user=admin` (unquoted) or `user="admin"` (quoted) will always perform an exact match, when in fact they can behave differently depending on the field's data type and the presence of special characters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
user=admin OR user=root
Using unquoted field comparisons with the OR operator performs an exact match for simple values like 'admin' and 'root'. In Splunk, when field values do not contain spaces or special characters, unquoted values are treated as exact match tokens. Therefore, `user=admin OR user=root` will retrieve events where the user field is exactly 'admin' or 'root'. Option A is also valid but less concise. Option B uses wildcards, matching any occurrence, not exact. Option C uses the IN operator, which is another exact match method, but option D is equally correct and often considered more straightforward for this simple case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
user="admin" OR user="root"
Why it's wrong here
Uses quoted values with OR, which is correct for exact match but less concise than option D.
- ✗
user=*admin* OR user=*root*
Why it's wrong here
Uses wildcards, matching any occurrence of 'admin' or 'root' within the field, not an exact match.
- ✗
user IN ("admin", "root")
Why it's wrong here
Uses the IN operator, which is also an exact match method, but it is not necessarily better than option D for simple values.
- ✓
user=admin OR user=root
Why this is correct
Correct. Unquoted values perform exact match for simple strings, making this a valid and straightforward filter.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.