SPLK-1002 Macros, Saved Searches and CIM Practice Question
A Splunk admin wants to create a saved search that triggers an alert when the average CPU usage across all servers exceeds 80% over a 5-minute window. The data is in a 'perfmon' sourcetype. Which search best fits this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | bucket _time span=5m | stats avg(Value) as avg_cpu by host | where avg_cpu > 80
It uses `earliest=-5m latest=now` to restrict the time range to the last 5 minutes, `bucket _time span=5m` to explicitly define the 5-minute window (even though the range is exactly 5 minutes, this ensures proper grouping for saved searches that may run later), `stats avg(Value) as avg_cpu by host` to compute the average per host within that window, and `where avg_cpu > 80` to filter hosts exceeding 80%. Option A uses `timechart`, which creates a separate series per time bucket and host, making the `where` clause ineffective (it would try to compare a field that doesn't exist). Option B omits the `bucket`, so the average is computed over the entire 5-minute range without explicit windowing, which can cause issues if the saved search runs with a different time range. Option C uses `streamstats`, which calculates a running average rather than a fixed-window average, not matching the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=os sourcetype=perfmon counter="% Processor Time" | timechart avg(Value) as avg_cpu by host | where avg_cpu > 80
Why it's wrong here
timechart creates one series per host but does not limit time range; requires additional filtering.
- ✗
index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | stats avg(Value) as avg_cpu by host | where avg_cpu > 80
Why it's wrong here
Without bucket, it averages the Value over the entire 5-minute period event count, which is not per window of 5 minutes.
- ✗
index=os sourcetype=perfmon counter="% Processor Time" | streamstats avg(Value) as avg_cpu by host | where avg_cpu > 80
Why it's wrong here
streamstats computes running average over all time, not over a 5-minute window.
- ✓
index=os sourcetype=perfmon counter="% Processor Time" earliest=-5m latest=now | bucket _time span=5m | stats avg(Value) as avg_cpu by host | where avg_cpu > 80
Why this is correct
Correctly batches events into 5-minute buckets per host and filters where average exceeds 80.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.