Top Sources Excluding a Specific Host
A user wants to create a report that shows the top 5 sources of errors, excluding a specific source 'host1'. Which SPL is correct?
Quick Answer
The critical detail in this scenario is the order of operations: filtering has to happen before aggregation for the aggregation to be accurate. Placing NOT host='host1' in the base search removes all events from that host before anything downstream ever sees them, so when the top command runs afterward, it's calculating the top 5 error sources purely from the remaining, already-filtered data. If the exclusion were applied after top instead, the top 5 would first be calculated including host1's data, and only then would host1 potentially be removed from that already-finalized list, which could leave you with fewer than 5 results or a ranking that doesn't reflect what the true top 5 would have been without host1 in the mix at all. Filtering early in the base search is also more efficient, since it reduces the volume of data every subsequent command has to process, rather than computing statistics over excess data and discarding results afterward. This is a broadly applicable principle for SPL: exclusions and filters that are meant to shape which data counts toward a statistic should generally be applied as early as possible in the pipeline, ideally in the base search itself, so that commands like top, stats, or chart are only ever operating on the data that should actually count.
⚠ Common exam trap
Splunk often tests the misconception that filtering after a transforming command like `top` is equivalent to filtering before it, when in reality the aggregation is performed on the entire dataset first, altering the results.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=main sourcetype=access_combined status>400 NOT host="host1" | top limit=5 source
It filters out 'host1' before the `top` command runs, ensuring that the top 5 sources of errors are calculated from the remaining data. The `NOT host="host1"` clause is placed in the base search, which is the most efficient approach and guarantees that 'host1' is excluded from the statistical aggregation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
index=main sourcetype=access_combined status>400 NOT host="host1" | top limit=5 source
Why this is correct
Correctly excludes host1 before top, ensuring accurate top 5.
- ✗
index=main sourcetype=access_combined status>400 | top limit=5 source | where source!="host1"
Why it's wrong here
Filters after top, same issue as A.
- ✗
index=main sourcetype=access_combined status>400 | top limit=5 source | search source!="host1"
Why it's wrong here
Filters after top, so host1 may appear in top list.
- ✗
index=main sourcetype=access_combined status>400 | search NOT host=host1 | top limit=5 source
Why it's wrong here
Syntax error: NOT without field name is ambiguous.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user wants to find the top 5 sourcetypes by event count over the last 24 hours. Which search is correct?
easy- A.index=* | eventcount | top sourcetype
- B.index=* | stats count by sourcetype | top 5 sourcetype
- ✓ C.index=* | stats count by sourcetype | sort -count | head 5
- D.index=* | top sourcetype
Why C: Option C correctly uses stats to count events by sourcetype, then sorts in descending order and limits to top 5 with head. Option A contains the invalid command 'eventcount', not a real Splunk command. Option B uses invalid syntax 'top 5 sourcetype'; the correct syntax is 'top limit=5 sourcetype'. Option D returns the top 10 sourcetypes by default, not the top 5.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.