How to Calculate Average Latency per Web Server for Successful Requests
A security analyst wants to calculate the average latency for each web server over the past hour, but only for requests where the status code is 200. The search result includes fields: server, latency, status. Which search correctly accomplishes this?
Quick Answer
The requirement in this scenario has two parts that need to happen in the right order: restrict the data to successful requests, and then compute an average per server, and the search handles both by filtering status=200 directly in the search string before the stats command runs. Because that filter is applied upfront, only events representing status=200 requests ever reach the stats stage, so avg(latency) by server is computed exclusively from that already-restricted dataset, giving you the true average latency for successful requests per server without needing any conditional logic inside the stats command itself. This is simpler and more efficient than trying to filter status codes after aggregation, because the base search's job is precisely to narrow down which events are eligible before any statistics are calculated on them. Doing the filtering early also means stats only has to process relevant events, which keeps the aggregation both correct and efficient rather than computing an average over a mixed dataset and correcting it afterward. As a general rule for SPL questions, when a scenario specifies a condition that should apply to every row before an aggregate is calculated, look for that condition expressed as a straightforward search-time filter ahead of the stats command rather than something layered into the aggregation logic itself.
⚠ Common exam trap
Many candidates think they can filter after stats using where, but stats collapses events into summary statistics, so a subsequent where cannot filter the original events used in the aggregation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=web sourcetype=access status=200 | stats avg(latency) by server
It filters events to only those with status=200 before the stats command, ensuring the average latency is calculated exclusively over successful requests. The stats command then computes the average latency grouped by server, which directly answers the requirement without needing conditional logic or post-filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=web sourcetype=access | eval good_latency=if(status=200, latency, null) | stats avg(good_latency) by server
Why it's wrong here
This includes all events but sets null for non-200; stats skips null but still counts all events, which is not the same as filtering.
- ✗
index=web sourcetype=access | eventstats avg(latency) by server | where status=200
Why it's wrong here
eventstats adds average to each event, then filters, but returns individual events, not a summary.
- ✗
index=web sourcetype=access | stats avg(latency) by server | where status=200
Why it's wrong here
The where clause is applied after stats, but stats removed the status field unless included in the by clause.
- ✓
index=web sourcetype=access status=200 | stats avg(latency) by server
Why this is correct
Correctly filters only status=200 events before statistical aggregation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An analyst needs to calculate the average response time for each web server, but only for requests that returned status code 200. The field 'response_time' is numeric. Which search correctly achieves this?
medium- A.index=web | transaction server maxspan=1m | stats avg(response_time) by server
- B.index=web status=200 | eventstats avg(response_time) as avg_time by server
- C.index=web | eval avg_time = avg(response_time) by server | search status=200
- ✓ D.index=web status=200 | stats avg(response_time) by server
Why D: It first filters the data to only include events with status=200 using a search-time field filter, then uses the `stats` command with `avg(response_time) by server` to compute the average response time per server. This ensures that only successful requests are included in the aggregation, and the `by server` clause correctly groups the results by each web server.
Variation 2. An analyst wants to calculate the average response time for each web server, but only for requests that returned status code 200. Which search accomplishes this?
easy- A.index=web sourcetype=access status=200 | sort host | stats avg(response_time)
- B.index=web sourcetype=access | eval avg_time=avg(response_time) by host | where status=200
- ✓ C.index=web sourcetype=access status=200 | stats avg(response_time) by host
- D.index=web sourcetype=access | stats avg(response_time) by host | search status=200
Why C: It first filters events with `status=200` (only successful requests), then uses `stats avg(response_time) by host` to compute the average response time per web server. This ensures the aggregation is performed only on the relevant subset of data, matching the requirement precisely.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.