SPLK-1002 Advanced Searching and Statistics Practice Question

Match each Splunk search command to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Calculates aggregate statistics on search results

Extracts fields using regular expressions

Creates or modifies fields using expressions

Groups events into transactions based on common fields

Enriches events with external data from a lookup table

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

eval: Evaluate expressions and assign to new fields

These are common Splunk search commands used for data manipulation and enrichment.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
eval: Evaluate expressions and assign to new fields
Why this is correct
eval is correctly defined as evaluating expressions and assigning results to new fields.
✓
rex: Extract fields using regular expressions
Why this is correct
rex is correctly defined as extracting fields using regular expressions.
✓
stats: Calculate statistics on search results
Why this is correct
stats is correctly defined as calculating statistics on search results.
✓
lookup: Enrich events with data from external sources
Why this is correct
lookup is correctly defined as enriching events with data from external sources.
✗
eval: Extract fields using regular expressions
Why it's wrong here
Incorrect — this describes rex, not eval. eval evaluates expressions and assigns to new fields.
✗
stats: Enrich events with data from external sources
Why it's wrong here
Incorrect — this describes lookup, not stats. stats calculates statistics on search results.

Go deeper