SPLK-1002 Event filtering Practice Question
A team uses a large index with many sourcetypes. They want to identify categories of events that have at least 100 occurrences, compute the average response_time per category, and return the top 5 categories with the highest average response_time. Which search best optimizes performance?
⚠ Common exam trap
This question tests the ability to identify the most efficient use of stats aggregations. Candidates may mistakenly select options that use multiple piped commands (like eventstats) for what can be accomplished with a single stats, assuming they are more powerful, when in fact they add overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5
Option D is correct because it uses a single stats command to compute both avg(response_time) and count (cnt) by category, then filters, sorts, and limits the results efficiently. Option A uses eventstats followed by stats—this is less efficient and the avg field is lost after stats count, making the sort invalid. Option B uses the top command, which does not compute the correct average and may not properly enforce the count threshold across all categories. Option C computes avg by category but omits the count, so the where cnt>=100 condition will fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=main | eventstats avg(response_time) as avg by category | stats count as cnt by category | where cnt>=100 | sort -avg | head 5
Why it's wrong here
This option uses eventstats and stats to compute average and count per category, but it does not filter events based on status or response_time. It also references 'avg' in a sort command after the where clause, which is not allowed.
- ✗
index=main | top category | eval avg=avg(response_time) | where count>=100
Why it's wrong here
This option uses top category and then attempts to compute average with eval, but it does not filter events and has incorrect syntax (eval cannot compute avg on a field without aggregation).
- ✗
index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5
Why it's wrong here
This option uses stats to compute average by category but does not include a count field, so the subsequent 'where cnt>=100' will fail because 'cnt' is not defined. No status filter is applied.
- ✓
index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5
Why this is correct
This option computes both average and count per category correctly, but it still does not filter events by status or response_time, which is the primary requirement of the question.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.