SPLK-1002 timechart Practice Question
A security analyst wants to visualize the count of login failures per hour, grouped by source IP. Which SPL command should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
timechart count by src_ip
Timechart automatically creates a time-based chart and can split by a field using 'by src_ip'. Option B is incorrect because stats produces a table, not a time-based chart, and does not automatically bin by time. Option C is incorrect because chart requires an explicit 'span' to create time-based bins, unlike timechart. Option D is incorrect because eventstats adds a new field but does not produce a visualization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
timechart count by src_ip
Why this is correct
Correct. timechart automatically bins events by time and groups by src_ip.
- ✗
stats count by _time, src_ip
Why it's wrong here
Incorrect. stats count by _time, src_ip produces a table, not a time-based chart; it does not automatically create bins over time.
- ✗
chart count by src_ip over _time
Why it's wrong here
This command fails to group login failures "per hour" because `over _time` uses raw event timestamps, not binned hourly intervals. It would display counts for each precise `_time` value, not aggregated by hour, which is crucial for hourly visualisation. The command is tempting as it correctly uses `_time` for the x-axis and groups by `src_ip`. It would be appropriate if the goal was to visualise counts by source IP against exact event timestamps, without any time-based aggregation or binning.
- ✗
eventstats count by src_ip
Why it's wrong here
Incorrect. eventstats count by src_ip creates a new field but does not produce a visualization.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.