SPLK-1002 Advanced Searching and Statistics Practice Question
A security analyst needs to find all login events where the user 'jsmith' attempted to authenticate from an IP address outside the corporate subnet (10.0.0.0/8) after business hours (after 18:00). Which search correctly filters for these events?
⚠ Common exam trap
It's easy for candidates to assume simple string or inequality operators (like `!=` or `like`) can handle CIDR subnet matching, but Splunk requires the `cidrmatch` function for accurate network range evaluation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip)
It uses the `cidrmatch` function to properly evaluate whether the source IP falls within the 10.0.0.0/8 subnet. The `where` clause with `date_hour > 18` correctly filters for events after business hours, and the `NOT cidrmatch` ensures only IPs outside the corporate subnet are included. This approach handles CIDR notation accurately, unlike simple string or inequality comparisons.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
index=main sourcetype=login user=jsmith | where 'date_hour' > 18 | where NOT cidrmatch("10.0.0.0/8", src_ip)
Why this is correct
Correctly uses `where` with `cidrmatch` and filters by hour.
- ✗
index=main sourcetype=login user=jsmith date_hour>18 | search NOT src_ip=10.0.0.0/8
Why it's wrong here
`search` does not support CIDR notation; use `where` with `cidrmatch`.
- ✗
index=main sourcetype=login user=jsmith date_hour>18 | where not src_ip like "10.%"
Why it's wrong here
Using `like` is not recommended for IP ranges; it may miss class A addresses like 10.x.x.x.
- ✗
index=main sourcetype=login user=jsmith date_hour>18 | where src_ip!=10.0.0.0/8
Why it's wrong here
`!=` does not work with CIDR; use `cidrmatch` function.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.