Advanced Searching and Statistics →mediumMultiple ChoiceObjective-mapped

SPLK-1002 Advanced Searching and Statistics Practice Question

Exhibit

Refer to the exhibit.
```
index=web sourcetype=access_combined
| rex "(?<ip>\d+\.\d+\.\d+\.\d+) (?<method>\w+) (?<uri>[^ ]+)"
| stats count by uri, method
| sort - count
| head 5
```

The exhibit shows a search to find the top 5 URI-method combinations by count. However, the results show only 5 rows, but the analyst expected to see the top 5 URIs overall, not combinations. Which change to the search would achieve the desired result?

⚠ Common exam trap

Splunk often tests the distinction between grouping by multiple fields versus a single field, and the trap here is that candidates may think they need an additional stats command (Option D) or a filter (Option A) when simply removing the extra field from the `by` clause is the correct and efficient fix.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change `stats count by uri, method` to `stats count by uri`.

The original search uses `stats count by uri, method`, which groups results by both URI and method, producing separate counts for each combination. Changing it to `stats count by uri` removes the method field from the grouping, so the count is aggregated per URI alone, giving the top 5 URIs overall as the analyst expected.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add `| where method="GET"` before stats.
Why it's wrong here
Filters to GET only, not overall top URIs.
✗
Replace `stats` with `chart count over uri by method`.
Why it's wrong here
Chart would create a table with methods as columns, not a simple top 5 list.
✗
Use `top limit=5 uri, method` instead.
Why it's wrong here
Top with two fields still shows combinations, not just URIs.
✗
Add `| stats sum(count) as total by uri` after the existing stats.
Why it's wrong here
This would sum counts but still include method in earlier stats; the second stats would sum over method, but the first stats already separated by method; this could work but is unnecessary; also the head would be applied before second stats? Actually head is after sort, so it would take top 5 combinations, then second stats would sum those 5, not all. So not correct.
✓
Change `stats count by uri, method` to `stats count by uri`.
Why this is correct
Correct: grouping only by uri gives count per URI.

Go deeper

SPLK-1002 Advanced Searching and Statistics Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question