Using eventstats to Compare User Metrics to Overall Average
Exhibit
index=security sourcetype=windows_logon | eval logon_hour=strftime(_time, "%H") | stats count by logon_hour, user | eventstats avg(count) as avg_count by logon_hour | where count > avg_count * 2
Refer to the exhibit. What does the final result represent?
Quick Answer
This search combines two commands that work together but do different jobs: eventstats computes an aggregate value, here the average logon count per hour, and attaches that value to every original event without collapsing them into a summary row, and where then filters those enriched events using a per-event comparison. Because eventstats preserves the original per-user, per-hour granularity while also making the overall hourly average available on each event, the subsequent where clause can compare an individual value against that group-level baseline directly, which is exactly what's needed to flag any user whose hourly logon count is more than double the hourly average. This is the defining reason to reach for eventstats instead of stats in this kind of scenario: stats would collapse the data down to just the aggregate, losing the individual user-level rows you need to actually apply the more-than-double comparison against. The result is a search that surfaces individual anomalies relative to a computed baseline rather than just reporting the baseline itself. Whenever an exam scenario needs you to compare an individual event's value against a computed group statistic, like an average, count, or threshold derived from the same dataset, and still needs the original event-level rows preserved for filtering, eventstats followed by a where clause is the pattern to look for.
⚠ Common exam trap
Candidates often confuse `eventstats ... by hour` (which computes a global average per hour) with a per-user average, leading them to incorrectly select option D or A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hours where any user's logon count is more than double the average for that hour.
The `eventstats` command calculates a per-hour average logon count across all users. The `where` clause then filters for events where a specific user's logon count for that hour is more than double that hourly average. This directly matches option C: hours where any user's logon count exceeds twice the average for that hour.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Users who log on more than twice on average.
Why it's wrong here
No averaging across hours
- ✗
Hours where the total logon count is more than double the average.
Why it's wrong here
Eventstats averages per hour, not total
- ✓
Hours where any user's logon count is more than double the average for that hour.
Why this is correct
Correct: per hour, per user comparison to hour average
- ✗
Users who have a logon count greater than twice their personal average.
Why it's wrong here
Average is per hour, not per user
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. This search is intended to find users with average duration above overall average. However, it returns no results. Why?
medium- A.eventstats should be after stats
- B.The where clause should use the 'search' command
- ✓ C.overall_avg is not available in the where clause because it is created in eventstats
- D.The search requires a subquery to compute overall_avg
Why C: The search uses eventstats to compute overall_avg, adding it to each event. Then the stats command groups by user, computing user_avg, but it does not retain overall_avg in the output. Therefore, when the where clause references overall_avg, that field no longer exists, causing the search to return no results. Option A is wrong because eventstats before stats is the correct order to compute overall_avg from all events. Option B is wrong because the where clause is appropriate for filtering; no need to use search command here. Option D is wrong because a subquery is not required; the issue is the field being dropped.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.