SPLK-1002 Advanced Searching and Statistics Practice Question
A user runs a search on web access logs: `index=web | eventstats sum(bytes) as total_bytes by host`. The search returns the correct total bytes per host, but now the user needs to calculate the average bytes per host for each event. Which command should be added to the base search to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats.
Adding `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats computes the average bytes per host for each event, preserving all raw events. Option B is incorrect because streamstats would compute a running (cumulative) average, not the overall average per host. Option C is incorrect because it attempts `eval avg_bytes = total_bytes / count`, but `count` is not a field available in each event; moreover, it would require a per-host count, which is not directly available without another aggregation. Option D is inefficient and unnecessary, as `stats` would aggregate away the events, and `join` is slow and can cause issues with large datasets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add `| eventstats avg(bytes) as avg_bytes by host` after the first eventstats.
Why this is correct
eventstats can compute average directly and add it to each event.
- ✗
Replace eventstats with `| streamstats avg(bytes) as avg_bytes by host`.
Why it's wrong here
streamstats computes a running average over the stream, not overall.
- ✗
Add `| eval avg_bytes = total_bytes / count` after the eventstats.
Why it's wrong here
Requires a count field which is not present unless also computed.
- ✗
Use `| stats avg(bytes) by host` then `| join host [search index=web]`.
Why it's wrong here
This approach fails because `stats` collapses the dataset into a summary table, removing individual event records required for per-event calculations. To append data to existing events without losing them, `eventstats` is necessary. This logic is tempting because `join` and `stats` are standard tools for combining disparate datasets or creating summary reports from multiple sources, but they cannot preserve the original event granularity needed here.
Go deeper
Related to this question
About these practice questions
One of 475 original SPLK-1002 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.